diff --git a/test/iosacl/cluster-tests.fwb b/test/iosacl/cluster-tests.fwb
index f7c939522..c5e5f7e90 100644
--- a/test/iosacl/cluster-tests.fwb
+++ b/test/iosacl/cluster-tests.fwb
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
-<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="20" lastModified="1253911075" id="root">
+<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="21" lastModified="1253911075" id="root">
   <Library id="syslib000" color="#d4f8ff" name="Standard" comment="Standard objects" ro="True">
     <AnyNetwork id="sysid0" name="Any" comment="Any Network" ro="False" address="0.0.0.0" netmask="0.0.0.0"/>
     <AnyIPService id="sysid1" protocol_num="0" name="Any" comment="Any IP Service" ro="False"/>
@@ -51,9 +51,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -69,9 +69,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -100,16 +100,16 @@
     </ObjectGroup>
     <ServiceGroup id="stdid05" name="Services" comment="" ro="False">
       <CustomService id="stdid14_1" name="ESTABLISHED" comment="This service matches all packets which are part of network connections established through the firewall, or connections 'related' to those established through the firewall. Term 'established' refers to the state tracking mechanism which exists inside iptables and other stateful firewalls and does not mean any particular combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful inspection module made appropriate record in the state table. Usually stateful firewalls keep track of network connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' describes packet belonging to a separate network connection, related to the session firewall is keeping track of. One example is FTP command and FTP data sessions." ro="False" protocol="any" address_family="ipv4">
-        <CustomServiceCommand platform="Undefined"/>
+        <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
         <CustomServiceCommand platform="iosacl">established</CustomServiceCommand>
-        <CustomServiceCommand platform="ipfilter"/>
+        <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
         <CustomServiceCommand platform="ipfw">established</CustomServiceCommand>
         <CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
       </CustomService>
       <CustomService id="stdid14_2" name="ESTABLISHED ipv6" comment="This service matches all packets which are part of network connections established through the firewall, or connections 'related' to those established through the firewall. Term 'established' refers to the state tracking mechanism which exists inside iptables and other stateful firewalls and does not mean any particular combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful inspection module made appropriate record in the state table. Usually stateful firewalls keep track of network connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' describes packet belonging to a separate network connection, related to the session firewall is keeping track of. One example is FTP command and FTP data sessions." ro="False" protocol="any" address_family="ipv6">
-        <CustomServiceCommand platform="Undefined"/>
+        <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
         <CustomServiceCommand platform="iosacl">established</CustomServiceCommand>
-        <CustomServiceCommand platform="ipfilter"/>
+        <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
         <CustomServiceCommand platform="ipfw">established</CustomServiceCommand>
         <CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
       </CustomService>
@@ -350,54 +350,54 @@
       </ServiceGroup>
       <ServiceGroup id="stdid13" name="Custom" comment="" ro="False">
         <CustomService id="id3B64EEA8" name="rpc" comment="works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"/>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfilter"/>
-          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m record_rpc</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
         <CustomService id="id3B64EF4E" name="irc-conn" comment="IRC connection tracker, supports DCC.&#10;Works on iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/&#10;" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"/>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfilter"/>
-          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m irc</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
         <CustomService id="id3B64EF50" name="psd" comment="Port scan detector, works only on iptables and  requires patch-o-matic &#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"/>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfilter"/>
-          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m psd --psd-weight-threshold 5 --psd-delay-threshold 10000</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
         <CustomService id="id3B64EF52" name="string" comment="Matches a string in a whole packet, works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"/>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfilter"/>
-          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m string --string test_pattern</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
         <CustomService id="id3B64EF54" name="talk" comment="Talk protocol support. Works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"/>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfilter"/>
-          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m talk</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
       </ServiceGroup>
       <ServiceGroup id="stdid19" name="TagServices" comment="" ro="False"/>
@@ -420,7 +420,7 @@
     <FailoverClusterGroup id="id2719X89830" type="vrrp" name="cluster3:vrrp0:members" comment="">
       <ClusterGroupOptions>
         <Option name="vrrp_secret">vrrp_secret</Option>
-        <Option name="vrrp_vrid"/>
+        <Option name="vrrp_vrid"></Option>
       </ClusterGroupOptions>
     </FailoverClusterGroup>
     <StateSyncClusterGroup id="id2762X92940" type="conntrack" name="State Sync Group-1" comment="">
@@ -438,18 +438,18 @@
         <Option name="iface_disablearp">False</Option>
         <Option name="iface_disableboot">False</Option>
         <Option name="iface_mtu">1500</Option>
-        <Option name="iface_options"/>
+        <Option name="iface_options"></Option>
         <Option name="type">bridge</Option>
-        <Option name="vlan_id"/>
+        <Option name="vlan_id"></Option>
       </InterfaceOptions>
       <Interface id="id10491X48869" dedicated_failover="False" dyn="False" label="" security_level="0" unnum="False" unprotected="False" name="eth2" comment="" ro="False">
         <InterfaceOptions>
           <Option name="iface_disablearp">False</Option>
           <Option name="iface_disableboot">False</Option>
           <Option name="iface_mtu">1500</Option>
-          <Option name="iface_options"/>
+          <Option name="iface_options"></Option>
           <Option name="type">ethernet</Option>
-          <Option name="vlan_id"/>
+          <Option name="vlan_id"></Option>
         </InterfaceOptions>
       </Interface>
       <Interface id="id10493X48869" dedicated_failover="False" dyn="False" label="" security_level="0" unnum="False" unprotected="False" name="eth3" comment="" ro="False">
@@ -486,7 +486,7 @@
         <Option name="iface_disablearp">False</Option>
         <Option name="iface_disableboot">False</Option>
         <Option name="iface_mtu">1500</Option>
-        <Option name="iface_options"/>
+        <Option name="iface_options"></Option>
         <Option name="type">8021q</Option>
         <Option name="vlan_id">100</Option>
       </InterfaceOptions>
@@ -497,275 +497,283 @@
         <Option name="iface_disablearp">False</Option>
         <Option name="iface_disableboot">False</Option>
         <Option name="iface_mtu">1500</Option>
-        <Option name="iface_options"/>
+        <Option name="iface_options"></Option>
         <Option name="type">8021q</Option>
         <Option name="vlan_id">101</Option>
       </InterfaceOptions>
     </Interface>
     <Cluster id="id3631X95766" host_OS="openbsd" inactive="False" lastCompiled="1244758659" lastInstalled="0" lastModified="1244757366" platform="pf" name="pf_cluster_1" comment="" ro="False">
       <NAT id="id3640X95766" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-        <NATRule id="id3162X39764" disabled="False" position="0" action="Translate" comment="">
-            <OSrc neg="False">
+        <NATRule id="id3162X39764" disabled="False" group="" position="0" action="Translate" comment="">
+          <OSrc neg="False">
             <ObjectRef ref="id3DC75CE7-1"/>
           </OSrc>
-            <ODst neg="False">
+          <ODst neg="False">
             <ObjectRef ref="sysid0"/>
           </ODst>
-            <OSrv neg="False">
+          <OSrv neg="False">
             <ServiceRef ref="sysid1"/>
           </OSrv>
-            <TSrc neg="False">
+          <TSrc neg="False">
             <ObjectRef ref="sysid0"/>
           </TSrc>
-            <TDst neg="False">
+          <TDst neg="False">
             <ObjectRef ref="sysid0"/>
           </TDst>
-            <TSrv neg="False">
+          <TSrv neg="False">
             <ServiceRef ref="sysid1"/>
           </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
-            <NATRuleOptions/>
-          </NATRule>
+          <ItfInb neg="False">
+            <ObjectRef ref="sysid0"/>
+          </ItfInb>
+          <ItfOutb neg="False">
+            <ObjectRef ref="sysid0"/>
+          </ItfOutb>
+          <NATRuleOptions/>
+        </NATRule>
         <NATRule id="id11381X39764" disabled="False" group="" position="1" action="Translate" comment="">
-            <OSrc neg="False">
+          <OSrc neg="False">
             <ObjectRef ref="id3DC75CE7-1"/>
           </OSrc>
-            <ODst neg="False">
+          <ODst neg="False">
             <ObjectRef ref="sysid0"/>
           </ODst>
-            <OSrv neg="False">
+          <OSrv neg="False">
             <ServiceRef ref="sysid1"/>
           </OSrv>
-            <TSrc neg="False">
+          <TSrc neg="False">
             <ObjectRef ref="sysid0"/>
           </TSrc>
-            <TDst neg="False">
+          <TDst neg="False">
             <ObjectRef ref="sysid0"/>
           </TDst>
-            <TSrv neg="False">
+          <TSrv neg="False">
             <ServiceRef ref="sysid1"/>
           </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
-            <NATRuleOptions/>
-          </NATRule>
+          <ItfInb neg="False">
+            <ObjectRef ref="sysid0"/>
+          </ItfInb>
+          <ItfOutb neg="False">
+            <ObjectRef ref="sysid0"/>
+          </ItfOutb>
+          <NATRuleOptions/>
+        </NATRule>
         <NATRule id="id11397X39764" disabled="False" group="" position="2" action="Translate" comment="">
-            <OSrc neg="False">
+          <OSrc neg="False">
             <ObjectRef ref="id3DC75CE7-1"/>
           </OSrc>
-            <ODst neg="False">
+          <ODst neg="False">
             <ObjectRef ref="sysid0"/>
           </ODst>
-            <OSrv neg="False">
+          <OSrv neg="False">
             <ServiceRef ref="sysid1"/>
           </OSrv>
-            <TSrc neg="False">
+          <TSrc neg="False">
             <ObjectRef ref="id11417X39764"/>
           </TSrc>
-            <TDst neg="False">
+          <TDst neg="False">
             <ObjectRef ref="sysid0"/>
           </TDst>
-            <TSrv neg="False">
+          <TSrv neg="False">
             <ServiceRef ref="sysid1"/>
           </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
-            <NATRuleOptions/>
-          </NATRule>
+          <ItfInb neg="False">
+            <ObjectRef ref="sysid0"/>
+          </ItfInb>
+          <ItfOutb neg="False">
+            <ObjectRef ref="sysid0"/>
+          </ItfOutb>
+          <NATRuleOptions/>
+        </NATRule>
         <NATRule id="id15078X39764" disabled="False" group="" position="3" action="Translate" comment="">
-            <OSrc neg="False">
+          <OSrc neg="False">
             <ObjectRef ref="sysid0"/>
           </OSrc>
-            <ODst neg="False">
+          <ODst neg="False">
             <ObjectRef ref="sysid0"/>
           </ODst>
-            <OSrv neg="False">
+          <OSrv neg="False">
             <ServiceRef ref="tcp-HTTP"/>
           </OSrv>
-            <TSrc neg="False">
+          <TSrc neg="False">
             <ObjectRef ref="sysid0"/>
           </TSrc>
-            <TDst neg="False">
+          <TDst neg="False">
             <ObjectRef ref="id15840X39764"/>
           </TDst>
-            <TSrv neg="False">
+          <TSrv neg="False">
             <ServiceRef ref="sysid1"/>
           </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
-            <NATRuleOptions/>
-          </NATRule>
+          <ItfInb neg="False">
+            <ObjectRef ref="sysid0"/>
+          </ItfInb>
+          <ItfOutb neg="False">
+            <ObjectRef ref="sysid0"/>
+          </ItfOutb>
+          <NATRuleOptions/>
+        </NATRule>
         <NATRule id="id16591X39764" disabled="False" group="" position="4" action="Translate" comment="">
-            <OSrc neg="False">
+          <OSrc neg="False">
             <ObjectRef ref="sysid0"/>
           </OSrc>
-            <ODst neg="False">
+          <ODst neg="False">
             <ObjectRef ref="sysid0"/>
           </ODst>
-            <OSrv neg="False">
+          <OSrv neg="False">
             <ServiceRef ref="tcp-HTTP"/>
           </OSrv>
-            <TSrc neg="False">
+          <TSrc neg="False">
             <ObjectRef ref="sysid0"/>
           </TSrc>
-            <TDst neg="False">
+          <TDst neg="False">
             <ObjectRef ref="id15840X39764"/>
           </TDst>
-            <TSrv neg="False">
+          <TSrv neg="False">
             <ServiceRef ref="sysid1"/>
           </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
-            <NATRuleOptions/>
-          </NATRule>
+          <ItfInb neg="False">
+            <ObjectRef ref="sysid0"/>
+          </ItfInb>
+          <ItfOutb neg="False">
+            <ObjectRef ref="sysid0"/>
+          </ItfOutb>
+          <NATRuleOptions/>
+        </NATRule>
         <NATRule id="id16611X39764" disabled="False" group="" position="5" action="Translate" comment="">
-            <OSrc neg="False">
+          <OSrc neg="False">
             <ObjectRef ref="sysid0"/>
           </OSrc>
-            <ODst neg="False">
+          <ODst neg="False">
             <ObjectRef ref="id11417X39764"/>
           </ODst>
-            <OSrv neg="False">
+          <OSrv neg="False">
             <ServiceRef ref="tcp-HTTP"/>
           </OSrv>
-            <TSrc neg="False">
+          <TSrc neg="False">
             <ObjectRef ref="sysid0"/>
           </TSrc>
-            <TDst neg="False">
+          <TDst neg="False">
             <ObjectRef ref="id15840X39764"/>
           </TDst>
-            <TSrv neg="False">
+          <TSrv neg="False">
             <ServiceRef ref="sysid1"/>
           </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
-            <NATRuleOptions/>
-          </NATRule>
+          <ItfInb neg="False">
+            <ObjectRef ref="sysid0"/>
+          </ItfInb>
+          <ItfOutb neg="False">
+            <ObjectRef ref="sysid0"/>
+          </ItfOutb>
+          <NATRuleOptions/>
+        </NATRule>
         <RuleSetOptions/>
       </NAT>
       <Policy id="id3639X95766" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
         <PolicyRule id="id5954X26920" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="">
-            <Src neg="False">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
             <Option name="stateless">False</Option>
-          
-          <Option name="pf_classify_str"/>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
+        </PolicyRule>
         <PolicyRule id="id7136X39764" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
-            <Src neg="False">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
             <Option name="stateless">False</Option>
-          
-          <Option name="pf_classify_str"/>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
+        </PolicyRule>
         <PolicyRule id="id7162X39764" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="">
-            <Src neg="False">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
             <Option name="stateless">False</Option>
-          
-          <Option name="pf_classify_str"/>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
+        </PolicyRule>
         <PolicyRule id="id7149X39764" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="">
-            <Src neg="False">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
             <Option name="stateless">False</Option>
-          
-          <Option name="pf_classify_str"/>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
-        <PolicyRule id="id5942X26920" disabled="False" log="True" position="4" action="Deny" direction="Both" comment="">
-            <Src neg="False">
+        </PolicyRule>
+        <PolicyRule id="id5942X26920" disabled="False" group="" log="True" position="4" action="Deny" direction="Both" comment="">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
             <Option name="stateless">True</Option>
-          
-          <Option name="pf_classify_str"/>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
+        </PolicyRule>
         <RuleSetOptions/>
       </Policy>
       <Routing id="id3641X95766" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
@@ -839,18 +847,18 @@
       </Management>
       <FirewallOptions>
         <Option name="accept_new_tcp_with_no_syn">False</Option>
-        <Option name="activationCmd"/>
-        <Option name="admUser"/>
-        <Option name="altAddress"/>
+        <Option name="activationCmd"></Option>
+        <Option name="admUser"></Option>
+        <Option name="altAddress"></Option>
         <Option name="check_shading">False</Option>
-        <Option name="cmdline"/>
-        <Option name="compiler"/>
+        <Option name="cmdline"></Option>
+        <Option name="compiler"></Option>
         <Option name="configure_carp_interfaces">True</Option>
         <Option name="configure_interfaces">True</Option>
         <Option name="configure_pfsync_interfaces">True</Option>
         <Option name="configure_vlan_interfaces">True</Option>
         <Option name="debug">False</Option>
-        <Option name="epilog_script"/>
+        <Option name="epilog_script"></Option>
         <Option name="fallback_log">False</Option>
         <Option name="firewall_dir">/etc</Option>
         <Option name="ignore_empty_groups">False</Option>
@@ -859,11 +867,11 @@
         <Option name="log_prefix">RULE %N -- %A </Option>
         <Option name="loopback_interface">lo0</Option>
         <Option name="manage_virtual_addr">True</Option>
-        <Option name="mgmt_addr"/>
+        <Option name="mgmt_addr"></Option>
         <Option name="mgmt_ssh">False</Option>
         <Option name="modulate_state">False</Option>
         <Option name="openbsd_ip_forward">1</Option>
-        <Option name="output_file"/>
+        <Option name="output_file"></Option>
         <Option name="pass_all_out">false</Option>
         <Option name="pf_adaptive_end">0</Option>
         <Option name="pf_adaptive_start">0</Option>
@@ -883,7 +891,7 @@
         <Option name="pf_limit_states">10000</Option>
         <Option name="pf_limit_table_entries">0</Option>
         <Option name="pf_limit_tables">0</Option>
-        <Option name="pf_optimization"/>
+        <Option name="pf_optimization"></Option>
         <Option name="pf_other_first">0</Option>
         <Option name="pf_other_multiple">0</Option>
         <Option name="pf_other_single">0</Option>
@@ -923,9 +931,9 @@
         <Option name="pf_udp_multiple">0</Option>
         <Option name="pf_udp_single">0</Option>
         <Option name="prolog_place">fw_file</Option>
-        <Option name="prolog_script"/>
-        <Option name="scpArgs"/>
-        <Option name="sshArgs"/>
+        <Option name="prolog_script"></Option>
+        <Option name="scpArgs"></Option>
+        <Option name="sshArgs"></Option>
       </FirewallOptions>
     </Firewall>
     <Firewall id="id3337X26920" host_OS="openbsd" inactive="False" lastCompiled="0" lastInstalled="0" lastModified="1244783399" platform="pf" version="4.x" name="openbsd-2" comment="" ro="False">
@@ -953,18 +961,18 @@
       </Management>
       <FirewallOptions>
         <Option name="accept_new_tcp_with_no_syn">False</Option>
-        <Option name="activationCmd"/>
-        <Option name="admUser"/>
-        <Option name="altAddress"/>
+        <Option name="activationCmd"></Option>
+        <Option name="admUser"></Option>
+        <Option name="altAddress"></Option>
         <Option name="check_shading">False</Option>
-        <Option name="cmdline"/>
-        <Option name="compiler"/>
+        <Option name="cmdline"></Option>
+        <Option name="compiler"></Option>
         <Option name="configure_carp_interfaces">True</Option>
         <Option name="configure_interfaces">True</Option>
         <Option name="configure_pfsync_interfaces">False</Option>
         <Option name="configure_vlan_interfaces">False</Option>
         <Option name="debug">False</Option>
-        <Option name="epilog_script"/>
+        <Option name="epilog_script"></Option>
         <Option name="fallback_log">False</Option>
         <Option name="firewall_dir">/etc</Option>
         <Option name="ignore_empty_groups">False</Option>
@@ -973,11 +981,11 @@
         <Option name="log_prefix">RULE %N -- %A </Option>
         <Option name="loopback_interface">lo0</Option>
         <Option name="manage_virtual_addr">True</Option>
-        <Option name="mgmt_addr"/>
+        <Option name="mgmt_addr"></Option>
         <Option name="mgmt_ssh">False</Option>
         <Option name="modulate_state">False</Option>
         <Option name="openbsd_ip_forward">1</Option>
-        <Option name="output_file"/>
+        <Option name="output_file"></Option>
         <Option name="pass_all_out">false</Option>
         <Option name="pf_adaptive_end">0</Option>
         <Option name="pf_adaptive_start">0</Option>
@@ -997,7 +1005,7 @@
         <Option name="pf_limit_states">10000</Option>
         <Option name="pf_limit_table_entries">0</Option>
         <Option name="pf_limit_tables">0</Option>
-        <Option name="pf_optimization"/>
+        <Option name="pf_optimization"></Option>
         <Option name="pf_other_first">0</Option>
         <Option name="pf_other_multiple">0</Option>
         <Option name="pf_other_single">0</Option>
@@ -1037,9 +1045,9 @@
         <Option name="pf_udp_multiple">0</Option>
         <Option name="pf_udp_single">0</Option>
         <Option name="prolog_place">fw_file</Option>
-        <Option name="prolog_script"/>
-        <Option name="scpArgs"/>
-        <Option name="sshArgs"/>
+        <Option name="prolog_script"></Option>
+        <Option name="scpArgs"></Option>
+        <Option name="sshArgs"></Option>
       </FirewallOptions>
     </Firewall>
     <Cluster id="id3867X13237" host_OS="linux24" lastCompiled="0" lastInstalled="0" lastModified="0" platform="iptables" name="vrrp_cluster_2" comment="" ro="False">
@@ -1127,9 +1135,9 @@
           <Option name="iface_disablearp">False</Option>
           <Option name="iface_disableboot">False</Option>
           <Option name="iface_mtu">1500</Option>
-          <Option name="iface_options"/>
+          <Option name="iface_options"></Option>
           <Option name="type">ethernet</Option>
-          <Option name="vlan_id"/>
+          <Option name="vlan_id"></Option>
         </InterfaceOptions>
       </Interface>
       <Interface id="id4038X2906" dedicated_failover="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
@@ -1147,28 +1155,28 @@
       <FirewallOptions>
         <Option name="accept_established">True</Option>
         <Option name="accept_new_tcp_with_no_syn">True</Option>
-        <Option name="action_on_reject"/>
-        <Option name="activationCmd"/>
-        <Option name="admUser"/>
-        <Option name="altAddress"/>
+        <Option name="action_on_reject"></Option>
+        <Option name="activationCmd"></Option>
+        <Option name="admUser"></Option>
+        <Option name="altAddress"></Option>
         <Option name="bridging_fw">False</Option>
         <Option name="check_shading">False</Option>
         <Option name="clamp_mss_to_mtu">False</Option>
         <Option name="classify_mark_terminating">False</Option>
-        <Option name="cmdline"/>
-        <Option name="compiler"/>
+        <Option name="cmdline"></Option>
+        <Option name="compiler"></Option>
         <Option name="configure_interfaces">True</Option>
         <Option name="debug">False</Option>
         <Option name="drop_invalid">False</Option>
         <Option name="eliminate_duplicates">true</Option>
-        <Option name="epilog_script"/>
+        <Option name="epilog_script"></Option>
         <Option name="firewall_dir">/etc</Option>
         <Option name="firewall_is_part_of_any_and_networks">True</Option>
         <Option name="flush_and_set_default_policy">True</Option>
         <Option name="freebsd_ip_forward">1</Option>
         <Option name="ignore_empty_groups">False</Option>
         <Option name="ipv4_6_order">ipv4_first</Option>
-        <Option name="limit_suffix"/>
+        <Option name="limit_suffix"></Option>
         <Option name="limit_value">0</Option>
         <Option name="linux24_ip_forward">1</Option>
         <Option name="load_modules">True</Option>
@@ -1183,11 +1191,11 @@
         <Option name="loopback_interface">lo</Option>
         <Option name="macosx_ip_forward">1</Option>
         <Option name="manage_virtual_addr">True</Option>
-        <Option name="mgmt_addr"/>
+        <Option name="mgmt_addr"></Option>
         <Option name="mgmt_ssh">False</Option>
         <Option name="modules_dir">/lib/modules/`uname -r`/kernel/net/</Option>
         <Option name="openbsd_ip_forward">1</Option>
-        <Option name="output_file"/>
+        <Option name="output_file"></Option>
         <Option name="pf_limit_frags">5000</Option>
         <Option name="pf_limit_states">10000</Option>
         <Option name="pf_timeout_frag">30</Option>
@@ -1205,13 +1213,13 @@
         <Option name="pix_syslog_device_id_supported">false</Option>
         <Option name="pix_use_acl_remarks">true</Option>
         <Option name="prolog_place">top</Option>
-        <Option name="prolog_script"/>
-        <Option name="scpArgs"/>
+        <Option name="prolog_script"></Option>
+        <Option name="scpArgs"></Option>
         <Option name="secuwall_add_files">False</Option>
         <Option name="secuwall_add_files_dir">/opt/secuwall/templates/default</Option>
         <Option name="secuwall_dns_reso1">files</Option>
         <Option name="solaris_ip_forward">1</Option>
-        <Option name="sshArgs"/>
+        <Option name="sshArgs"></Option>
         <Option name="ulog_cprange">0</Option>
         <Option name="ulog_nlgroup">1</Option>
         <Option name="ulog_qthreshold">1</Option>
@@ -1258,9 +1266,9 @@
           <Option name="iface_disablearp">False</Option>
           <Option name="iface_disableboot">False</Option>
           <Option name="iface_mtu">1500</Option>
-          <Option name="iface_options"/>
+          <Option name="iface_options"></Option>
           <Option name="type">bonding</Option>
-          <Option name="vlan_id"/>
+          <Option name="vlan_id"></Option>
         </InterfaceOptions>
         <Interface id="id3807X49120" dedicated_failover="False" dyn="False" label="" security_level="0" unnum="False" unprotected="False" name="eth2" comment="" ro="False">
           <InterfaceOptions>
@@ -1283,28 +1291,28 @@
       <FirewallOptions>
         <Option name="accept_established">True</Option>
         <Option name="accept_new_tcp_with_no_syn">True</Option>
-        <Option name="action_on_reject"/>
-        <Option name="activationCmd"/>
-        <Option name="admUser"/>
-        <Option name="altAddress"/>
+        <Option name="action_on_reject"></Option>
+        <Option name="activationCmd"></Option>
+        <Option name="admUser"></Option>
+        <Option name="altAddress"></Option>
         <Option name="bridging_fw">False</Option>
         <Option name="check_shading">False</Option>
         <Option name="clamp_mss_to_mtu">False</Option>
         <Option name="classify_mark_terminating">False</Option>
-        <Option name="cmdline"/>
-        <Option name="compiler"/>
+        <Option name="cmdline"></Option>
+        <Option name="compiler"></Option>
         <Option name="configure_interfaces">True</Option>
         <Option name="debug">False</Option>
         <Option name="drop_invalid">False</Option>
         <Option name="eliminate_duplicates">true</Option>
-        <Option name="epilog_script"/>
+        <Option name="epilog_script"></Option>
         <Option name="firewall_dir">/etc</Option>
         <Option name="firewall_is_part_of_any_and_networks">True</Option>
         <Option name="flush_and_set_default_policy">True</Option>
         <Option name="freebsd_ip_forward">1</Option>
         <Option name="ignore_empty_groups">False</Option>
         <Option name="ipv4_6_order">ipv4_first</Option>
-        <Option name="limit_suffix"/>
+        <Option name="limit_suffix"></Option>
         <Option name="limit_value">0</Option>
         <Option name="linux24_ip_forward">1</Option>
         <Option name="load_modules">True</Option>
@@ -1319,11 +1327,11 @@
         <Option name="loopback_interface">lo</Option>
         <Option name="macosx_ip_forward">1</Option>
         <Option name="manage_virtual_addr">True</Option>
-        <Option name="mgmt_addr"/>
+        <Option name="mgmt_addr"></Option>
         <Option name="mgmt_ssh">False</Option>
         <Option name="modules_dir">/lib/modules/`uname -r`/kernel/net/</Option>
         <Option name="openbsd_ip_forward">1</Option>
-        <Option name="output_file"/>
+        <Option name="output_file"></Option>
         <Option name="pf_limit_frags">5000</Option>
         <Option name="pf_limit_states">10000</Option>
         <Option name="pf_timeout_frag">30</Option>
@@ -1341,13 +1349,13 @@
         <Option name="pix_syslog_device_id_supported">false</Option>
         <Option name="pix_use_acl_remarks">true</Option>
         <Option name="prolog_place">top</Option>
-        <Option name="prolog_script"/>
-        <Option name="scpArgs"/>
+        <Option name="prolog_script"></Option>
+        <Option name="scpArgs"></Option>
         <Option name="secuwall_add_files">False</Option>
         <Option name="secuwall_add_files_dir">/opt/secuwall/templates/default</Option>
         <Option name="secuwall_dns_reso1">files</Option>
         <Option name="solaris_ip_forward">1</Option>
-        <Option name="sshArgs"/>
+        <Option name="sshArgs"></Option>
         <Option name="ulog_cprange">0</Option>
         <Option name="ulog_nlgroup">1</Option>
         <Option name="ulog_qthreshold">1</Option>
@@ -1362,29 +1370,27 @@
         <RuleSetOptions/>
       </NAT>
       <Policy id="id3816X36775" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-        <PolicyRule id="id4355X56095" disabled="False" log="False" position="0" action="Accept" direction="Both" comment="">
-            <Src neg="False">
+        <PolicyRule id="id4355X56095" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
             <Option name="stateless">False</Option>
-          
-          <Option name="pf_classify_str"/>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
+        </PolicyRule>
         <RuleSetOptions/>
       </Policy>
       <Routing id="id3818X36775" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
@@ -1413,7 +1419,7 @@
         <InterfaceOptions>
           <Option name="bonding_mode">blance xor</Option>
           <Option name="bonding_policy">balance-xor</Option>
-          <Option name="bondng_driver_options"/>
+          <Option name="bondng_driver_options"></Option>
           <Option name="dev_plus_vid">False</Option>
           <Option name="dev_plus_vid_no_pad">False</Option>
           <Option name="enable_stp">True</Option>
@@ -1443,12 +1449,12 @@
         <Interface id="id6778X41225" dedicated_failover="False" dyn="False" label="" security_level="0" unnum="False" unprotected="False" name="bond1.123" comment="" ro="False">
           <IPv4 id="id16320X39036" name="linux-bonding-1:bond1:bond1.123:ip" comment="" ro="False" address="172.16.2.1" netmask="255.255.255.0"/>
           <InterfaceOptions>
-            <Option name="bonding_policy"/>
-            <Option name="bondng_driver_options"/>
+            <Option name="bonding_policy"></Option>
+            <Option name="bondng_driver_options"></Option>
             <Option name="enable_stp">False</Option>
             <Option name="type">8021q</Option>
             <Option name="vlan_id">123</Option>
-            <Option name="xmit_hash_policy"/>
+            <Option name="xmit_hash_policy"></Option>
           </InterfaceOptions>
         </Interface>
       </Interface>
@@ -1474,16 +1480,16 @@
       <FirewallOptions>
         <Option name="accept_established">True</Option>
         <Option name="accept_new_tcp_with_no_syn">True</Option>
-        <Option name="action_on_reject"/>
-        <Option name="activationCmd"/>
-        <Option name="admUser"/>
-        <Option name="altAddress"/>
+        <Option name="action_on_reject"></Option>
+        <Option name="activationCmd"></Option>
+        <Option name="admUser"></Option>
+        <Option name="altAddress"></Option>
         <Option name="bridging_fw">False</Option>
         <Option name="check_shading">False</Option>
         <Option name="clamp_mss_to_mtu">False</Option>
         <Option name="classify_mark_terminating">False</Option>
-        <Option name="cmdline"/>
-        <Option name="compiler"/>
+        <Option name="cmdline"></Option>
+        <Option name="compiler"></Option>
         <Option name="configure_bonding_interfaces">True</Option>
         <Option name="configure_bridge_interfaces">True</Option>
         <Option name="configure_interfaces">True</Option>
@@ -1491,14 +1497,14 @@
         <Option name="debug">False</Option>
         <Option name="drop_invalid">False</Option>
         <Option name="eliminate_duplicates">true</Option>
-        <Option name="epilog_script"/>
+        <Option name="epilog_script"></Option>
         <Option name="firewall_dir">/etc</Option>
         <Option name="firewall_is_part_of_any_and_networks">True</Option>
         <Option name="flush_and_set_default_policy">True</Option>
         <Option name="freebsd_ip_forward">1</Option>
         <Option name="ignore_empty_groups">False</Option>
         <Option name="ipv4_6_order">ipv4_first</Option>
-        <Option name="limit_suffix"/>
+        <Option name="limit_suffix"></Option>
         <Option name="limit_value">0</Option>
         <Option name="linux24_ip_forward">1</Option>
         <Option name="load_modules">True</Option>
@@ -1513,11 +1519,11 @@
         <Option name="loopback_interface">lo</Option>
         <Option name="macosx_ip_forward">1</Option>
         <Option name="manage_virtual_addr">True</Option>
-        <Option name="mgmt_addr"/>
+        <Option name="mgmt_addr"></Option>
         <Option name="mgmt_ssh">False</Option>
         <Option name="modules_dir">/lib/modules/`uname -r`/kernel/net/</Option>
         <Option name="openbsd_ip_forward">1</Option>
-        <Option name="output_file"/>
+        <Option name="output_file"></Option>
         <Option name="pf_limit_frags">5000</Option>
         <Option name="pf_limit_states">10000</Option>
         <Option name="pf_timeout_frag">30</Option>
@@ -1535,13 +1541,13 @@
         <Option name="pix_syslog_device_id_supported">false</Option>
         <Option name="pix_use_acl_remarks">true</Option>
         <Option name="prolog_place">top</Option>
-        <Option name="prolog_script"/>
-        <Option name="scpArgs"/>
+        <Option name="prolog_script"></Option>
+        <Option name="scpArgs"></Option>
         <Option name="secuwall_add_files">False</Option>
         <Option name="secuwall_add_files_dir">/opt/secuwall/templates/default</Option>
         <Option name="secuwall_dns_reso1">files</Option>
         <Option name="solaris_ip_forward">1</Option>
-        <Option name="sshArgs"/>
+        <Option name="sshArgs"></Option>
         <Option name="ulog_cprange">0</Option>
         <Option name="ulog_nlgroup">1</Option>
         <Option name="ulog_qthreshold">1</Option>
@@ -1582,185 +1588,181 @@
     </Cluster>
     <Cluster id="id3433X13311" host_OS="linux24" inactive="False" lastCompiled="1251482764" lastInstalled="0" lastModified="1253910805" platform="iptables" name="heartbeat_cluster_1" comment="This is an example of linux/heartbeat cluster with two policy rule sets. Branching rule in the top policy passes control to rule set to_fw, which is different in member firewalls.  See ticket #372 for explanation.&#10;" ro="False">
       <NAT id="id3587X13311" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-        <NATRule id="id3588X13311" disabled="False" position="0" action="Translate" comment="">
-            <OSrc neg="False">
+        <NATRule id="id3588X13311" disabled="False" group="" position="0" action="Translate" comment="">
+          <OSrc neg="False">
             <ObjectRef ref="id3DC75CE7-1"/>
           </OSrc>
-            <ODst neg="False">
+          <ODst neg="False">
             <ObjectRef ref="sysid0"/>
           </ODst>
-            <OSrv neg="False">
+          <OSrv neg="False">
             <ServiceRef ref="sysid1"/>
           </OSrv>
-            <TSrc neg="False">
+          <TSrc neg="False">
             <ObjectRef ref="sysid0"/>
           </TSrc>
-            <TDst neg="False">
+          <TDst neg="False">
             <ObjectRef ref="sysid0"/>
           </TDst>
-            <TSrv neg="False">
+          <TSrv neg="False">
             <ServiceRef ref="sysid1"/>
           </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
-            <NATRuleOptions/>
-          </NATRule>
+          <ItfInb neg="False">
+            <ObjectRef ref="sysid0"/>
+          </ItfInb>
+          <ItfOutb neg="False">
+            <ObjectRef ref="sysid0"/>
+          </ItfOutb>
+          <NATRuleOptions/>
+        </NATRule>
         <RuleSetOptions/>
       </NAT>
       <Policy id="id3465X13311" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
         <PolicyRule id="id3466X13311" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="">
-            <Src neg="False">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="id3054X14356"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="id3068X14356"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
             <Option name="stateless">False</Option>
-          
-          <Option name="pf_classify_str"/>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
-        <PolicyRule id="id3478X13311" disabled="False" log="True" position="1" action="Deny" direction="Inbound" comment="anti spoofing rule">
-            <Src neg="False">
+        </PolicyRule>
+        <PolicyRule id="id3478X13311" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="anti spoofing rule">
+          <Src neg="False">
             <ObjectRef ref="id3DC75CE7-1"/>
             <ObjectRef ref="id3433X13311"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
-        <PolicyRule id="id3491X13311" disabled="False" log="False" position="2" action="Accept" direction="Both" comment="">
-            <Src neg="False">
+        </PolicyRule>
+        <PolicyRule id="id3491X13311" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
-        <PolicyRule id="id3503X13311" disabled="False" log="False" position="3" action="Accept" direction="Both" comment="SSH Access to firewall is permitted&#10;only from internal network">
-            <Src neg="False">
+        </PolicyRule>
+        <PolicyRule id="id3503X13311" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="SSH Access to firewall is permitted&#10;only from internal network">
+          <Src neg="False">
             <ObjectRef ref="id3DC75CE7-1"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="id3433X13311"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="tcp-SSH"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
+        </PolicyRule>
         <PolicyRule id="id3515X13311" disabled="False" group="" log="False" position="4" action="Accept" direction="Both" comment="SSH Access to firewall is permitted&#10;only from internal network">
-            <Src neg="False">
+          <Src neg="False">
             <ObjectRef ref="id3DC75CE7-1"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="tcp-SSH"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
-        <PolicyRule id="id3527X13311" disabled="False" log="True" position="5" action="Accept" direction="Both" comment="Firewall uses one of the machines&#10;on internal network for DNS">
-            <Src neg="False">
+        </PolicyRule>
+        <PolicyRule id="id3527X13311" disabled="False" group="" log="True" position="5" action="Accept" direction="Both" comment="Firewall uses one of the machines&#10;on internal network for DNS">
+          <Src neg="False">
             <ObjectRef ref="id3433X13311"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="id3DC75CE7-1"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="id3F530CC8"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
+        </PolicyRule>
         <PolicyRule id="id4369X67939" disabled="False" group="" log="False" position="6" action="Branch" direction="Both" comment="branch rule set is different in members linux-1 and linux-2">
-            <Src neg="False">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="id3433X13311"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
-            <Option name="action_on_reject"/>
+          <PolicyRuleOptions>
+            <Option name="action_on_reject"></Option>
             <Option name="branch_id">id6187X76214</Option>
-            <Option name="classify_str"/>
+            <Option name="classify_str"></Option>
             <Option name="connlimit_masklen">0</Option>
             <Option name="connlimit_value">0</Option>
-            <Option name="custom_str"/>
+            <Option name="custom_str"></Option>
             <Option name="firewall_is_part_of_any_and_networks">False</Option>
             <Option name="hashlimit_burst">0</Option>
             <Option name="hashlimit_dstlimit">False</Option>
@@ -1771,58 +1773,56 @@
             <Option name="hashlimit_mode_dstport">False</Option>
             <Option name="hashlimit_mode_srcip">False</Option>
             <Option name="hashlimit_mode_srcport">False</Option>
-            <Option name="hashlimit_name"/>
+            <Option name="hashlimit_name"></Option>
             <Option name="hashlimit_size">0</Option>
-            <Option name="hashlimit_suffix"/>
+            <Option name="hashlimit_suffix"></Option>
             <Option name="hashlimit_value">0</Option>
-            <Option name="ipf_route_opt_addr"/>
-            <Option name="ipf_route_opt_if"/>
+            <Option name="ipf_route_opt_addr"></Option>
+            <Option name="ipf_route_opt_if"></Option>
             <Option name="ipf_route_option">route_through</Option>
             <Option name="ipfw_classify_method">2</Option>
             <Option name="ipfw_pipe_port_num">0</Option>
             <Option name="ipfw_pipe_queue_num">0</Option>
             <Option name="ipt_branch_in_mangle">False</Option>
             <Option name="ipt_continue">False</Option>
-            <Option name="ipt_gw"/>
-            <Option name="ipt_iif"/>
+            <Option name="ipt_gw"></Option>
+            <Option name="ipt_iif"></Option>
             <Option name="ipt_mark_connections">False</Option>
-            <Option name="ipt_oif"/>
+            <Option name="ipt_oif"></Option>
             <Option name="ipt_tee">False</Option>
             <Option name="limit_burst">0</Option>
-            <Option name="limit_suffix"/>
+            <Option name="limit_suffix"></Option>
             <Option name="limit_value">0</Option>
-            <Option name="log_level"/>
-            <Option name="log_prefix"/>
+            <Option name="log_level"></Option>
+            <Option name="log_prefix"></Option>
+            <Option name="pf_classify_str"></Option>
             <Option name="pf_fastroute">False</Option>
             <Option name="pf_route_load_option">none</Option>
-            <Option name="pf_route_opt_addr"/>
-            <Option name="pf_route_opt_if"/>
+            <Option name="pf_route_opt_addr"></Option>
+            <Option name="pf_route_opt_if"></Option>
             <Option name="pf_route_option">none</Option>
-            <Option name="rule_name_accounting"/>
+            <Option name="rule_name_accounting"></Option>
             <Option name="stateless">True</Option>
             <Option name="ulog_nlgroup">1</Option>
-          
-          <Option name="pf_classify_str"/>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
-        <PolicyRule id="id3539X13311" disabled="False" log="True" position="7" action="Deny" direction="Both" comment="">
-            <Src neg="False">
+        </PolicyRule>
+        <PolicyRule id="id3539X13311" disabled="False" group="" log="True" position="7" action="Deny" direction="Both" comment="">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="id3433X13311"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
+          <PolicyRuleOptions>
             <Option name="connlimit_masklen">0</Option>
             <Option name="connlimit_value">0</Option>
             <Option name="firewall_is_part_of_any_and_networks">False</Option>
@@ -1835,94 +1835,88 @@
             <Option name="hashlimit_mode_dstport">False</Option>
             <Option name="hashlimit_mode_srcip">False</Option>
             <Option name="hashlimit_mode_srcport">False</Option>
-            <Option name="hashlimit_name"/>
+            <Option name="hashlimit_name"></Option>
             <Option name="hashlimit_size">0</Option>
-            <Option name="hashlimit_suffix"/>
+            <Option name="hashlimit_suffix"></Option>
             <Option name="hashlimit_value">0</Option>
             <Option name="limit_burst">0</Option>
-            <Option name="limit_suffix"/>
+            <Option name="limit_suffix"></Option>
             <Option name="limit_value">0</Option>
-            <Option name="log_level"/>
-            <Option name="log_prefix"/>
+            <Option name="log_level"></Option>
+            <Option name="log_prefix"></Option>
+            <Option name="pf_classify_str"></Option>
             <Option name="stateless">True</Option>
             <Option name="ulog_nlgroup">1</Option>
-          
-          <Option name="pf_classify_str"/>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
-        <PolicyRule id="id3551X13311" disabled="False" log="False" position="8" action="Accept" direction="Both" comment="">
-            <Src neg="False">
+        </PolicyRule>
+        <PolicyRule id="id3551X13311" disabled="False" group="" log="False" position="8" action="Accept" direction="Both" comment="">
+          <Src neg="False">
             <ObjectRef ref="id3DC75CE7-1"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
-        <PolicyRule id="id3563X13311" disabled="False" log="True" position="9" action="Deny" direction="Both" comment="">
-            <Src neg="False">
+        </PolicyRule>
+        <PolicyRule id="id3563X13311" disabled="False" group="" log="True" position="9" action="Deny" direction="Both" comment="">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
+        </PolicyRule>
         <PolicyRule id="id3575X13311" disabled="False" group="" log="True" position="10" action="Deny" direction="Both" comment="">
-            <Src neg="False">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
             <Option name="stateless">True</Option>
-          
-          <Option name="pf_classify_str"/>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
+        </PolicyRule>
         <RuleSetOptions/>
       </Policy>
       <Policy id="id6187X76214" name="to_fw" comment="this is a placeholder ruleset used in branching rule in Policy&#10;Member firewalls linux-1 and linux-2 have their own copy&#10;of the rule set with the same name which is used." ro="False" ipv4_rule_set="True" ipv6_rule_set="False" top_rule_set="False">
         <RuleSetOptions/>
       </Policy>
       <Routing id="id3602X13311" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-        <RoutingRule id="id97243X57559" disabled="False" metric="0" position="0" comment="">
+        <RoutingRule id="id97243X57559" disabled="False" group="" metric="0" position="0" comment="">
           <RDst neg="False">
             <ObjectRef ref="id95767X57559"/>
           </RDst>
@@ -1969,7 +1963,7 @@
         </FailoverClusterGroup>
       </Interface>
       <FirewallOptions>
-        <Option name="ipt_mangle_only_rulesets"/>
+        <Option name="ipt_mangle_only_rulesets"></Option>
       </FirewallOptions>
       <StateSyncClusterGroup id="id3604X13311" master_iface="id2843X69605" type="conntrack" name="State Sync Group" comment="">
         <ObjectRef ref="id2843X69605"/>
@@ -1982,179 +1976,175 @@
     </Cluster>
     <Cluster id="id4400X28690" host_OS="linux24" inactive="False" lastCompiled="1248555910" lastInstalled="0" lastModified="1253911350" platform="iptables" name="openais_cluster_1" comment="" ro="False">
       <NAT id="id4568X28690" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-        <NATRule id="id4569X28690" disabled="False" position="0" action="Translate" comment="">
-            <OSrc neg="False">
+        <NATRule id="id4569X28690" disabled="False" group="" position="0" action="Translate" comment="">
+          <OSrc neg="False">
             <ObjectRef ref="id3DC75CE7-1"/>
           </OSrc>
-            <ODst neg="False">
+          <ODst neg="False">
             <ObjectRef ref="sysid0"/>
           </ODst>
-            <OSrv neg="False">
+          <OSrv neg="False">
             <ServiceRef ref="sysid1"/>
           </OSrv>
-            <TSrc neg="False">
+          <TSrc neg="False">
             <ObjectRef ref="sysid0"/>
           </TSrc>
-            <TDst neg="False">
+          <TDst neg="False">
             <ObjectRef ref="sysid0"/>
           </TDst>
-            <TSrv neg="False">
+          <TSrv neg="False">
             <ServiceRef ref="sysid1"/>
           </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
-            <NATRuleOptions/>
-          </NATRule>
+          <ItfInb neg="False">
+            <ObjectRef ref="sysid0"/>
+          </ItfInb>
+          <ItfOutb neg="False">
+            <ObjectRef ref="sysid0"/>
+          </ItfOutb>
+          <NATRuleOptions/>
+        </NATRule>
         <RuleSetOptions/>
       </NAT>
       <Policy id="id4434X28690" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
         <PolicyRule id="id4435X28690" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="">
-            <Src neg="False">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="id3054X14356"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="id3068X14356"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
             <Option name="stateless">False</Option>
-          
-          <Option name="pf_classify_str"/>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
-        <PolicyRule id="id4447X28690" disabled="False" log="True" position="1" action="Deny" direction="Inbound" comment="anti spoofing rule">
-            <Src neg="False">
+        </PolicyRule>
+        <PolicyRule id="id4447X28690" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="anti spoofing rule">
+          <Src neg="False">
             <ObjectRef ref="id3DC75CE7-1"/>
             <ObjectRef ref="id4400X28690"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
-        <PolicyRule id="id4460X28690" disabled="False" log="False" position="2" action="Accept" direction="Both" comment="">
-            <Src neg="False">
+        </PolicyRule>
+        <PolicyRule id="id4460X28690" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
-        <PolicyRule id="id4472X28690" disabled="False" log="False" position="3" action="Accept" direction="Both" comment="SSH Access to firewall is permitted&#10;only from internal network">
-            <Src neg="False">
+        </PolicyRule>
+        <PolicyRule id="id4472X28690" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="SSH Access to firewall is permitted&#10;only from internal network">
+          <Src neg="False">
             <ObjectRef ref="id3DC75CE7-1"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="id4400X28690"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="tcp-SSH"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
+        </PolicyRule>
         <PolicyRule id="id4484X28690" disabled="False" group="" log="False" position="4" action="Accept" direction="Both" comment="SSH Access to firewall is permitted&#10;only from internal network">
-            <Src neg="False">
+          <Src neg="False">
             <ObjectRef ref="id3DC75CE7-1"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="tcp-SSH"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
-        <PolicyRule id="id4496X28690" disabled="False" log="True" position="5" action="Accept" direction="Both" comment="Firewall uses one of the machines&#10;on internal network for DNS">
-            <Src neg="False">
+        </PolicyRule>
+        <PolicyRule id="id4496X28690" disabled="False" group="" log="True" position="5" action="Accept" direction="Both" comment="Firewall uses one of the machines&#10;on internal network for DNS">
+          <Src neg="False">
             <ObjectRef ref="id4400X28690"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="id3DC75CE7-1"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="id3F530CC8"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
+        </PolicyRule>
         <PolicyRule id="id4508X28690" disabled="False" group="" log="False" position="6" action="Deny" direction="Both" comment="">
-            <Src neg="False">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="id4400X28690"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
+          <PolicyRuleOptions>
             <Option name="connlimit_masklen">0</Option>
             <Option name="connlimit_value">0</Option>
             <Option name="firewall_is_part_of_any_and_networks">False</Option>
@@ -2167,39 +2157,37 @@
             <Option name="hashlimit_mode_dstport">False</Option>
             <Option name="hashlimit_mode_srcip">False</Option>
             <Option name="hashlimit_mode_srcport">False</Option>
-            <Option name="hashlimit_name"/>
+            <Option name="hashlimit_name"></Option>
             <Option name="hashlimit_size">0</Option>
-            <Option name="hashlimit_suffix"/>
+            <Option name="hashlimit_suffix"></Option>
             <Option name="hashlimit_value">0</Option>
             <Option name="limit_burst">0</Option>
-            <Option name="limit_suffix"/>
+            <Option name="limit_suffix"></Option>
             <Option name="limit_value">0</Option>
-            <Option name="log_level"/>
-            <Option name="log_prefix"/>
+            <Option name="log_level"></Option>
+            <Option name="log_prefix"></Option>
+            <Option name="pf_classify_str"></Option>
             <Option name="stateless">True</Option>
             <Option name="ulog_nlgroup">1</Option>
-          
-          <Option name="pf_classify_str"/>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
-        <PolicyRule id="id4520X28690" disabled="False" log="True" position="7" action="Deny" direction="Both" comment="">
-            <Src neg="False">
+        </PolicyRule>
+        <PolicyRule id="id4520X28690" disabled="False" group="" log="True" position="7" action="Deny" direction="Both" comment="">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="id4400X28690"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
+          <PolicyRuleOptions>
             <Option name="connlimit_masklen">0</Option>
             <Option name="connlimit_value">0</Option>
             <Option name="firewall_is_part_of_any_and_networks">False</Option>
@@ -2212,91 +2200,85 @@
             <Option name="hashlimit_mode_dstport">False</Option>
             <Option name="hashlimit_mode_srcip">False</Option>
             <Option name="hashlimit_mode_srcport">False</Option>
-            <Option name="hashlimit_name"/>
+            <Option name="hashlimit_name"></Option>
             <Option name="hashlimit_size">0</Option>
-            <Option name="hashlimit_suffix"/>
+            <Option name="hashlimit_suffix"></Option>
             <Option name="hashlimit_value">0</Option>
             <Option name="limit_burst">0</Option>
-            <Option name="limit_suffix"/>
+            <Option name="limit_suffix"></Option>
             <Option name="limit_value">0</Option>
-            <Option name="log_level"/>
-            <Option name="log_prefix"/>
+            <Option name="log_level"></Option>
+            <Option name="log_prefix"></Option>
+            <Option name="pf_classify_str"></Option>
             <Option name="stateless">True</Option>
             <Option name="ulog_nlgroup">1</Option>
-          
-          <Option name="pf_classify_str"/>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
-        <PolicyRule id="id4532X28690" disabled="False" log="False" position="8" action="Accept" direction="Both" comment="">
-            <Src neg="False">
+        </PolicyRule>
+        <PolicyRule id="id4532X28690" disabled="False" group="" log="False" position="8" action="Accept" direction="Both" comment="">
+          <Src neg="False">
             <ObjectRef ref="id3DC75CE7-1"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
-        <PolicyRule id="id4544X28690" disabled="False" log="True" position="9" action="Deny" direction="Both" comment="">
-            <Src neg="False">
+        </PolicyRule>
+        <PolicyRule id="id4544X28690" disabled="False" group="" log="True" position="9" action="Deny" direction="Both" comment="">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
+        </PolicyRule>
         <PolicyRule id="id4556X28690" disabled="False" group="" log="True" position="10" action="Deny" direction="Both" comment="">
-            <Src neg="False">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
             <Option name="stateless">True</Option>
-          
-          <Option name="pf_classify_str"/>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
+        </PolicyRule>
         <RuleSetOptions/>
       </Policy>
       <Routing id="id4583X28690" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-        <RoutingRule id="id225294X57559" disabled="False" metric="0" position="0" comment="">
+        <RoutingRule id="id225294X57559" disabled="False" group="" metric="0" position="0" comment="">
           <RDst neg="False">
             <ObjectRef ref="id95767X57559"/>
           </RDst>
@@ -2368,179 +2350,175 @@
     </Cluster>
     <Cluster id="id2772X94039" host_OS="linux24" inactive="False" lastCompiled="1248541095" lastInstalled="0" lastModified="1253911174" platform="iptables" name="vrrp_cluster_1" comment="" ro="False">
       <NAT id="id2866X94039" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-        <NATRule id="id2867X94039" disabled="False" position="0" action="Translate" comment="">
-            <OSrc neg="False">
+        <NATRule id="id2867X94039" disabled="False" group="" position="0" action="Translate" comment="">
+          <OSrc neg="False">
             <ObjectRef ref="id3DC75CE7-1"/>
           </OSrc>
-            <ODst neg="False">
+          <ODst neg="False">
             <ObjectRef ref="sysid0"/>
           </ODst>
-            <OSrv neg="False">
+          <OSrv neg="False">
             <ServiceRef ref="sysid1"/>
           </OSrv>
-            <TSrc neg="False">
+          <TSrc neg="False">
             <ObjectRef ref="sysid0"/>
           </TSrc>
-            <TDst neg="False">
+          <TDst neg="False">
             <ObjectRef ref="sysid0"/>
           </TDst>
-            <TSrv neg="False">
+          <TSrv neg="False">
             <ServiceRef ref="sysid1"/>
           </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
-            <NATRuleOptions/>
-          </NATRule>
+          <ItfInb neg="False">
+            <ObjectRef ref="sysid0"/>
+          </ItfInb>
+          <ItfOutb neg="False">
+            <ObjectRef ref="sysid0"/>
+          </ItfOutb>
+          <NATRuleOptions/>
+        </NATRule>
         <RuleSetOptions/>
       </NAT>
       <Policy id="id2780X94039" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
         <PolicyRule id="id3055X14356" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="">
-            <Src neg="False">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="id3054X14356"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="id3068X14356"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
             <Option name="stateless">False</Option>
-          
-          <Option name="pf_classify_str"/>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
-        <PolicyRule id="id2781X94039" disabled="False" log="True" position="1" action="Deny" direction="Inbound" comment="anti spoofing rule">
-            <Src neg="False">
+        </PolicyRule>
+        <PolicyRule id="id2781X94039" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="anti spoofing rule">
+          <Src neg="False">
             <ObjectRef ref="id3DC75CE7-1"/>
             <ObjectRef ref="id2772X94039"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
-        <PolicyRule id="id2794X94039" disabled="False" log="False" position="2" action="Accept" direction="Both" comment="">
-            <Src neg="False">
+        </PolicyRule>
+        <PolicyRule id="id2794X94039" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
-        <PolicyRule id="id2806X94039" disabled="False" log="False" position="3" action="Accept" direction="Both" comment="SSH Access to firewall is permitted&#10;only from internal network">
-            <Src neg="False">
+        </PolicyRule>
+        <PolicyRule id="id2806X94039" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="SSH Access to firewall is permitted&#10;only from internal network">
+          <Src neg="False">
             <ObjectRef ref="id3DC75CE7-1"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="id2772X94039"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="tcp-SSH"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
+        </PolicyRule>
         <PolicyRule id="id3725X2234" disabled="False" group="" log="False" position="4" action="Accept" direction="Both" comment="SSH Access to firewall is permitted&#10;only from internal network">
-            <Src neg="False">
+          <Src neg="False">
             <ObjectRef ref="id3DC75CE7-1"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="tcp-SSH"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
-        <PolicyRule id="id2818X94039" disabled="False" log="True" position="5" action="Accept" direction="Both" comment="Firewall uses one of the machines&#10;on internal network for DNS">
-            <Src neg="False">
+        </PolicyRule>
+        <PolicyRule id="id2818X94039" disabled="False" group="" log="True" position="5" action="Accept" direction="Both" comment="Firewall uses one of the machines&#10;on internal network for DNS">
+          <Src neg="False">
             <ObjectRef ref="id2772X94039"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="id3DC75CE7-1"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="id3F530CC8"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
-        <PolicyRule id="id2830X94039" disabled="False" log="True" position="6" action="Deny" direction="Both" comment="All other attempts to connect to&#10;the firewall are denied and logged">
-            <Src neg="False">
+        </PolicyRule>
+        <PolicyRule id="id2830X94039" disabled="False" group="" log="True" position="6" action="Deny" direction="Both" comment="All other attempts to connect to&#10;the firewall are denied and logged">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="id2772X94039"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
+          <PolicyRuleOptions>
             <Option name="connlimit_masklen">0</Option>
             <Option name="connlimit_value">0</Option>
             <Option name="firewall_is_part_of_any_and_networks">False</Option>
@@ -2553,91 +2531,85 @@
             <Option name="hashlimit_mode_dstport">False</Option>
             <Option name="hashlimit_mode_srcip">False</Option>
             <Option name="hashlimit_mode_srcport">False</Option>
-            <Option name="hashlimit_name"/>
+            <Option name="hashlimit_name"></Option>
             <Option name="hashlimit_size">0</Option>
-            <Option name="hashlimit_suffix"/>
+            <Option name="hashlimit_suffix"></Option>
             <Option name="hashlimit_value">0</Option>
             <Option name="limit_burst">0</Option>
-            <Option name="limit_suffix"/>
+            <Option name="limit_suffix"></Option>
             <Option name="limit_value">0</Option>
-            <Option name="log_level"/>
-            <Option name="log_prefix"/>
+            <Option name="log_level"></Option>
+            <Option name="log_prefix"></Option>
+            <Option name="pf_classify_str"></Option>
             <Option name="stateless">True</Option>
             <Option name="ulog_nlgroup">1</Option>
-          
-          <Option name="pf_classify_str"/>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
-        <PolicyRule id="id2842X94039" disabled="False" log="False" position="7" action="Accept" direction="Both" comment="">
-            <Src neg="False">
+        </PolicyRule>
+        <PolicyRule id="id2842X94039" disabled="False" group="" log="False" position="7" action="Accept" direction="Both" comment="">
+          <Src neg="False">
             <ObjectRef ref="id3DC75CE7-1"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
-        <PolicyRule id="id2854X94039" disabled="False" log="True" position="8" action="Deny" direction="Both" comment="">
-            <Src neg="False">
+        </PolicyRule>
+        <PolicyRule id="id2854X94039" disabled="False" group="" log="True" position="8" action="Deny" direction="Both" comment="">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
+        </PolicyRule>
         <PolicyRule id="id3087X2234" disabled="False" group="" log="True" position="9" action="Deny" direction="Both" comment="">
-            <Src neg="False">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
             <Option name="stateless">True</Option>
-          
-          <Option name="pf_classify_str"/>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
+        </PolicyRule>
         <RuleSetOptions/>
       </Policy>
       <Routing id="id2881X94039" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-        <RoutingRule id="id146086X57559" disabled="False" metric="0" position="0" comment="">
+        <RoutingRule id="id146086X57559" disabled="False" group="" metric="0" position="0" comment="">
           <RDst neg="False">
             <ObjectRef ref="id95767X57559"/>
           </RDst>
@@ -2698,179 +2670,175 @@
     </Cluster>
     <Cluster id="id3937X13563" host_OS="linux24" lastCompiled="1248541096" lastInstalled="0" lastModified="1251419063" platform="iptables" name="vrrp_cluster_2" comment="" ro="False">
       <NAT id="id3941X13563" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-        <NATRule id="id5083X25627" disabled="False" position="0" action="Translate" comment="">
-            <OSrc neg="False">
+        <NATRule id="id5083X25627" disabled="False" group="" position="0" action="Translate" comment="">
+          <OSrc neg="False">
             <ObjectRef ref="id3DC75CE7-1"/>
           </OSrc>
-            <ODst neg="False">
+          <ODst neg="False">
             <ObjectRef ref="sysid0"/>
           </ODst>
-            <OSrv neg="False">
+          <OSrv neg="False">
             <ServiceRef ref="sysid1"/>
           </OSrv>
-            <TSrc neg="False">
+          <TSrc neg="False">
             <ObjectRef ref="sysid0"/>
           </TSrc>
-            <TDst neg="False">
+          <TDst neg="False">
             <ObjectRef ref="sysid0"/>
           </TDst>
-            <TSrv neg="False">
+          <TSrv neg="False">
             <ServiceRef ref="sysid1"/>
           </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
-            <NATRuleOptions/>
-          </NATRule>
+          <ItfInb neg="False">
+            <ObjectRef ref="sysid0"/>
+          </ItfInb>
+          <ItfOutb neg="False">
+            <ObjectRef ref="sysid0"/>
+          </ItfOutb>
+          <NATRuleOptions/>
+        </NATRule>
         <RuleSetOptions/>
       </NAT>
       <Policy id="id3940X13563" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
         <PolicyRule id="id5257X25627" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="">
-            <Src neg="False">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="id3054X14356"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="id3068X14356"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
             <Option name="stateless">False</Option>
-          
-          <Option name="pf_classify_str"/>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
-        <PolicyRule id="id5239X25627" disabled="False" log="True" position="1" action="Deny" direction="Inbound" comment="anti spoofing rule">
-            <Src neg="False">
+        </PolicyRule>
+        <PolicyRule id="id5239X25627" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="anti spoofing rule">
+          <Src neg="False">
             <ObjectRef ref="id3DC75CE7-1"/>
             <ObjectRef ref="id3937X13563"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
-        <PolicyRule id="id5222X25627" disabled="False" log="False" position="2" action="Accept" direction="Both" comment="">
-            <Src neg="False">
+        </PolicyRule>
+        <PolicyRule id="id5222X25627" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
-        <PolicyRule id="id5205X25627" disabled="False" log="False" position="3" action="Accept" direction="Both" comment="SSH Access to firewall is permitted&#10;only from internal network">
-            <Src neg="False">
+        </PolicyRule>
+        <PolicyRule id="id5205X25627" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="SSH Access to firewall is permitted&#10;only from internal network">
+          <Src neg="False">
             <ObjectRef ref="id3DC75CE7-1"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="id3937X13563"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="tcp-SSH"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
+        </PolicyRule>
         <PolicyRule id="id5188X25627" disabled="False" group="" log="False" position="4" action="Accept" direction="Both" comment="SSH Access to firewall is permitted&#10;only from internal network">
-            <Src neg="False">
+          <Src neg="False">
             <ObjectRef ref="id3DC75CE7-1"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="tcp-SSH"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
-        <PolicyRule id="id5171X25627" disabled="False" log="True" position="5" action="Accept" direction="Both" comment="Firewall uses one of the machines&#10;on internal network for DNS">
-            <Src neg="False">
+        </PolicyRule>
+        <PolicyRule id="id5171X25627" disabled="False" group="" log="True" position="5" action="Accept" direction="Both" comment="Firewall uses one of the machines&#10;on internal network for DNS">
+          <Src neg="False">
             <ObjectRef ref="id3937X13563"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="id3DC75CE7-1"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="id3F530CC8"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
-        <PolicyRule id="id5154X25627" disabled="False" log="True" position="6" action="Deny" direction="Both" comment="All other attempts to connect to&#10;the firewall are denied and logged">
-            <Src neg="False">
+        </PolicyRule>
+        <PolicyRule id="id5154X25627" disabled="False" group="" log="True" position="6" action="Deny" direction="Both" comment="All other attempts to connect to&#10;the firewall are denied and logged">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="id3937X13563"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
+          <PolicyRuleOptions>
             <Option name="connlimit_masklen">0</Option>
             <Option name="connlimit_value">0</Option>
             <Option name="firewall_is_part_of_any_and_networks">False</Option>
@@ -2883,87 +2851,81 @@
             <Option name="hashlimit_mode_dstport">False</Option>
             <Option name="hashlimit_mode_srcip">False</Option>
             <Option name="hashlimit_mode_srcport">False</Option>
-            <Option name="hashlimit_name"/>
+            <Option name="hashlimit_name"></Option>
             <Option name="hashlimit_size">0</Option>
-            <Option name="hashlimit_suffix"/>
+            <Option name="hashlimit_suffix"></Option>
             <Option name="hashlimit_value">0</Option>
             <Option name="limit_burst">0</Option>
-            <Option name="limit_suffix"/>
+            <Option name="limit_suffix"></Option>
             <Option name="limit_value">0</Option>
-            <Option name="log_level"/>
-            <Option name="log_prefix"/>
+            <Option name="log_level"></Option>
+            <Option name="log_prefix"></Option>
+            <Option name="pf_classify_str"></Option>
             <Option name="stateless">True</Option>
             <Option name="ulog_nlgroup">1</Option>
-          
-          <Option name="pf_classify_str"/>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
-        <PolicyRule id="id5137X25627" disabled="False" log="False" position="7" action="Accept" direction="Both" comment="">
-            <Src neg="False">
+        </PolicyRule>
+        <PolicyRule id="id5137X25627" disabled="False" group="" log="False" position="7" action="Accept" direction="Both" comment="">
+          <Src neg="False">
             <ObjectRef ref="id3DC75CE7-1"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
-        <PolicyRule id="id5120X25627" disabled="False" log="True" position="8" action="Deny" direction="Both" comment="">
-            <Src neg="False">
+        </PolicyRule>
+        <PolicyRule id="id5120X25627" disabled="False" group="" log="True" position="8" action="Deny" direction="Both" comment="">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
+        </PolicyRule>
         <PolicyRule id="id5103X25627" disabled="False" group="" log="True" position="9" action="Deny" direction="Both" comment="">
-            <Src neg="False">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
           </Src>
-            <Dst neg="False">
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
           </Dst>
-            <Srv neg="False">
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
           </Srv>
-            <Itf neg="False">
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
           </Itf>
-            <When neg="False">
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
+          <PolicyRuleOptions>
+            <Option name="pf_classify_str"></Option>
             <Option name="stateless">True</Option>
-          
-          <Option name="pf_classify_str"/>
           </PolicyRuleOptions>
-  
-          </PolicyRule>
+        </PolicyRule>
         <RuleSetOptions/>
       </Policy>
       <Routing id="id3942X13563" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
@@ -3075,16 +3037,16 @@
       <FirewallOptions>
         <Option name="accept_established">True</Option>
         <Option name="accept_new_tcp_with_no_syn">True</Option>
-        <Option name="action_on_reject"/>
-        <Option name="activationCmd"/>
-        <Option name="admUser"/>
-        <Option name="altAddress"/>
+        <Option name="action_on_reject"></Option>
+        <Option name="activationCmd"></Option>
+        <Option name="admUser"></Option>
+        <Option name="altAddress"></Option>
         <Option name="bridging_fw">False</Option>
         <Option name="check_shading">False</Option>
         <Option name="clamp_mss_to_mtu">False</Option>
         <Option name="classify_mark_terminating">False</Option>
-        <Option name="cmdline"/>
-        <Option name="compiler"/>
+        <Option name="cmdline"></Option>
+        <Option name="compiler"></Option>
         <Option name="configure_bonding_interfaces">True</Option>
         <Option name="configure_bridge_interfaces">True</Option>
         <Option name="configure_interfaces">True</Option>
@@ -3092,14 +3054,14 @@
         <Option name="debug">False</Option>
         <Option name="drop_invalid">False</Option>
         <Option name="eliminate_duplicates">true</Option>
-        <Option name="epilog_script"/>
+        <Option name="epilog_script"></Option>
         <Option name="firewall_dir">/etc</Option>
         <Option name="firewall_is_part_of_any_and_networks">True</Option>
         <Option name="flush_and_set_default_policy">True</Option>
         <Option name="freebsd_ip_forward">1</Option>
         <Option name="ignore_empty_groups">False</Option>
         <Option name="ipv4_6_order">ipv4_first</Option>
-        <Option name="limit_suffix"/>
+        <Option name="limit_suffix"></Option>
         <Option name="limit_value">0</Option>
         <Option name="linux24_ip_forward">1</Option>
         <Option name="load_modules">True</Option>
@@ -3114,11 +3076,11 @@
         <Option name="loopback_interface">lo</Option>
         <Option name="macosx_ip_forward">1</Option>
         <Option name="manage_virtual_addr">True</Option>
-        <Option name="mgmt_addr"/>
+        <Option name="mgmt_addr"></Option>
         <Option name="mgmt_ssh">False</Option>
         <Option name="modules_dir">/lib/modules/`uname -r`/kernel/net/</Option>
         <Option name="openbsd_ip_forward">1</Option>
-        <Option name="output_file"/>
+        <Option name="output_file"></Option>
         <Option name="pf_limit_frags">5000</Option>
         <Option name="pf_limit_states">10000</Option>
         <Option name="pf_timeout_frag">30</Option>
@@ -3136,13 +3098,13 @@
         <Option name="pix_syslog_device_id_supported">false</Option>
         <Option name="pix_use_acl_remarks">true</Option>
         <Option name="prolog_place">top</Option>
-        <Option name="prolog_script"/>
-        <Option name="scpArgs"/>
+        <Option name="prolog_script"></Option>
+        <Option name="scpArgs"></Option>
         <Option name="secuwall_add_files">False</Option>
         <Option name="secuwall_add_files_dir">/opt/secuwall/templates/default</Option>
         <Option name="secuwall_dns_reso1">files</Option>
         <Option name="solaris_ip_forward">1</Option>
-        <Option name="sshArgs"/>
+        <Option name="sshArgs"></Option>
         <Option name="ulog_cprange">0</Option>
         <Option name="ulog_nlgroup">1</Option>
         <Option name="ulog_qthreshold">1</Option>
@@ -3162,7 +3124,7 @@
     <ObjectGroup id="id1502X69605" name="Clusters" comment="" ro="False">
       <Cluster id="id2366X75741" host_OS="ios" inactive="True" lastCompiled="1248670597" lastInstalled="0" lastModified="1269894292" platform="iosacl" name="cluster1" comment="" ro="False">
         <NAT id="id2370X75741" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id4606X78273" disabled="False" position="0" action="Translate" comment="">
+          <NATRule id="id4606X78273" disabled="False" group="" position="0" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </OSrc>
@@ -3181,15 +3143,18 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
         </NAT>
         <Policy id="id2369X75741" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id2913X78273" disabled="False" log="True" position="0" action="Deny" direction="Inbound" comment="anti spoofing rule">
+          <PolicyRule id="id2913X78273" disabled="False" group="" log="True" position="0" action="Deny" direction="Inbound" comment="anti spoofing rule">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
               <ObjectRef ref="id2366X75741"/>
@@ -3207,11 +3172,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id2896X78273" disabled="False" log="False" position="1" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id2896X78273" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3228,11 +3192,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id2879X78273" disabled="False" log="False" position="2" action="Accept" direction="Both" comment="SSH Access to firewall is permitted&#10;only from internal network">
+          <PolicyRule id="id2879X78273" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="SSH Access to firewall is permitted&#10;only from internal network">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </Src>
@@ -3249,11 +3212,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id2862X78273" disabled="False" log="True" position="3" action="Accept" direction="Both" comment="Firewall uses one of the machines&#10;on internal network for DNS">
+          <PolicyRule id="id2862X78273" disabled="False" group="" log="True" position="3" action="Accept" direction="Both" comment="Firewall uses one of the machines&#10;on internal network for DNS">
             <Src neg="False">
               <ObjectRef ref="id2366X75741"/>
             </Src>
@@ -3270,11 +3232,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id2845X78273" disabled="False" log="True" position="4" action="Deny" direction="Both" comment="All other attempts to connect to&#10;the firewall are denied and logged">
+          <PolicyRule id="id2845X78273" disabled="False" group="" log="True" position="4" action="Deny" direction="Both" comment="All other attempts to connect to&#10;the firewall are denied and logged">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3291,11 +3252,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id2828X78273" disabled="False" log="False" position="5" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id2828X78273" disabled="False" group="" log="False" position="5" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </Src>
@@ -3312,11 +3272,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id2811X78273" disabled="False" log="True" position="6" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id2811X78273" disabled="False" group="" log="True" position="6" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3333,9 +3292,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -3417,7 +3375,7 @@
           <RuleSetOptions/>
         </Policy>
         <Policy id="id6188X76214" name="to_fw" comment="" ro="False" ipv4_rule_set="True" ipv6_rule_set="False" top_rule_set="False">
-          <PolicyRule id="id10428X76214" disabled="False" log="True" position="0" action="Deny" direction="Both" comment="hashlimit 10/sec">
+          <PolicyRule id="id10428X76214" disabled="False" group="" log="True" position="0" action="Deny" direction="Both" comment="hashlimit 10/sec">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3446,21 +3404,19 @@
               <Option name="hashlimit_mode_dstport">False</Option>
               <Option name="hashlimit_mode_srcip">False</Option>
               <Option name="hashlimit_mode_srcport">False</Option>
-              <Option name="hashlimit_name"/>
+              <Option name="hashlimit_name"></Option>
               <Option name="hashlimit_size">0</Option>
               <Option name="hashlimit_suffix">/second</Option>
               <Option name="hashlimit_value">10</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">1</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -3499,16 +3455,16 @@
         <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
-          <Option name="action_on_reject"/>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="action_on_reject"></Option>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="classify_mark_terminating">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="configure_vlan_interfaces">True</Option>
           <Option name="ctiqbe_fixup">2 2748 0 nil 0</Option>
@@ -3516,7 +3472,7 @@
           <Option name="dns_fixup">2 65535 0 nil 0</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="eliminate_duplicates">true</Option>
-          <Option name="epilog_script"/>
+          <Option name="epilog_script"></Option>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
@@ -3532,9 +3488,9 @@
           <Option name="iosacl_add_clear_statements">true</Option>
           <Option name="iosacl_assume_fw_part_of_any">true</Option>
           <Option name="iosacl_include_comments">true</Option>
-          <Option name="ipt_mangle_only_rulesets"/>
+          <Option name="ipt_mangle_only_rulesets"></Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
-          <Option name="limit_suffix"/>
+          <Option name="limit_suffix"></Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">1</Option>
           <Option name="load_modules">True</Option>
@@ -3550,11 +3506,11 @@
           <Option name="macosx_ip_forward">1</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modules_dir">/lib/modules/`uname -r`/kernel/net/</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
           <Option name="pf_timeout_frag">30</Option>
@@ -3574,10 +3530,10 @@
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="pptp_fixup">2 1723 0 nil 0</Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"/>
+          <Option name="prolog_script"></Option>
           <Option name="rsh_fixup">2 514 0 nil 0</Option>
           <Option name="rtsp_fixup">2 554 0 nil 0</Option>
-          <Option name="scpArgs"/>
+          <Option name="scpArgs"></Option>
           <Option name="secuwall_add_files">False</Option>
           <Option name="secuwall_add_files_dir">/opt/secuwall/templates/default</Option>
           <Option name="secuwall_dns_reso1">files</Option>
@@ -3587,7 +3543,7 @@
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
           <Option name="solaris_ip_forward">1</Option>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
@@ -3606,7 +3562,7 @@
           <RuleSetOptions/>
         </Policy>
         <Policy id="id6191X76214" name="to_fw" comment="" ro="False" ipv4_rule_set="True" ipv6_rule_set="False" top_rule_set="False">
-          <PolicyRule id="id10440X76214" disabled="False" log="True" position="0" action="Deny" direction="Both" comment="hashlimit 20/sec">
+          <PolicyRule id="id10440X76214" disabled="False" group="" log="True" position="0" action="Deny" direction="Both" comment="hashlimit 20/sec">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3635,21 +3591,19 @@
               <Option name="hashlimit_mode_dstport">False</Option>
               <Option name="hashlimit_mode_srcip">False</Option>
               <Option name="hashlimit_mode_srcport">False</Option>
-              <Option name="hashlimit_name"/>
+              <Option name="hashlimit_name"></Option>
               <Option name="hashlimit_size">0</Option>
               <Option name="hashlimit_suffix">/second</Option>
               <Option name="hashlimit_value">20</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">1</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -3676,21 +3630,21 @@
         <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
-          <Option name="action_on_reject"/>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="action_on_reject"></Option>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="classify_mark_terminating">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="eliminate_duplicates">true</Option>
-          <Option name="epilog_script"/>
+          <Option name="epilog_script"></Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="flush_and_set_default_policy">True</Option>
@@ -3699,9 +3653,9 @@
           <Option name="iosacl_add_clear_statements">true</Option>
           <Option name="iosacl_assume_fw_part_of_any">true</Option>
           <Option name="iosacl_include_comments">true</Option>
-          <Option name="ipt_mangle_only_rulesets"/>
+          <Option name="ipt_mangle_only_rulesets"></Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
-          <Option name="limit_suffix"/>
+          <Option name="limit_suffix"></Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">1</Option>
           <Option name="load_modules">True</Option>
@@ -3716,11 +3670,11 @@
           <Option name="loopback_interface">lo</Option>
           <Option name="macosx_ip_forward">1</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modules_dir">/lib/modules/`uname -r`/kernel/net/</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
           <Option name="pf_timeout_frag">30</Option>
@@ -3738,13 +3692,13 @@
           <Option name="pix_syslog_device_id_supported">false</Option>
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"/>
-          <Option name="scpArgs"/>
+          <Option name="prolog_script"></Option>
+          <Option name="scpArgs"></Option>
           <Option name="secuwall_add_files">False</Option>
           <Option name="secuwall_add_files_dir">/opt/secuwall/templates/default</Option>
           <Option name="secuwall_dns_reso1">files</Option>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
diff --git a/test/iosacl/objects-for-regression-tests.fwb b/test/iosacl/objects-for-regression-tests.fwb
index 5d840b92c..db5341504 100644
--- a/test/iosacl/objects-for-regression-tests.fwb
+++ b/test/iosacl/objects-for-regression-tests.fwb
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
-<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="20" lastModified="1269897518" id="root">
+<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="21" lastModified="1269897518" id="root">
   <Library id="syslib000" color="#d4f8ff" name="Standard" comment="Standard objects" ro="True">
     <AnyNetwork id="sysid0" name="Any" comment="Any Network" ro="False" address="0.0.0.0" netmask="0.0.0.0"/>
     <AnyIPService id="sysid1" protocol_num="0" name="Any" comment="Any IP Service" ro="False"/>
@@ -51,9 +51,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -69,9 +69,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -100,17 +100,17 @@
     </ObjectGroup>
     <ServiceGroup id="stdid05" name="Services" comment="" ro="False">
       <CustomService id="stdid14_1" name="ESTABLISHED" comment="This service matches all packets which are part of network connections established through the firewall, or connections 'related' to those established through the firewall. Term 'established' refers to the state tracking mechanism which exists inside iptables and other stateful firewalls and does not mean any particular combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful inspection module made appropriate record in the state table. Usually stateful firewalls keep track of network connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' describes packet belonging to a separate network connection, related to the session firewall is keeping track of. One example is FTP command and FTP data sessions." ro="False" protocol="any" address_family="ipv4">
-        <CustomServiceCommand platform="Undefined"/>
+        <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
         <CustomServiceCommand platform="iosacl">established</CustomServiceCommand>
-        <CustomServiceCommand platform="ipfilter"/>
+        <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
         <CustomServiceCommand platform="ipfw">established</CustomServiceCommand>
         <CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
         <CustomServiceCommand platform="procurve_acl">established</CustomServiceCommand>
       </CustomService>
       <CustomService id="stdid14_2" name="ESTABLISHED ipv6" comment="This service matches all packets which are part of network connections established through the firewall, or connections 'related' to those established through the firewall. Term 'established' refers to the state tracking mechanism which exists inside iptables and other stateful firewalls and does not mean any particular combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful inspection module made appropriate record in the state table. Usually stateful firewalls keep track of network connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' describes packet belonging to a separate network connection, related to the session firewall is keeping track of. One example is FTP command and FTP data sessions." ro="False" protocol="any" address_family="ipv6">
-        <CustomServiceCommand platform="Undefined"/>
+        <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
         <CustomServiceCommand platform="iosacl">established</CustomServiceCommand>
-        <CustomServiceCommand platform="ipfilter"/>
+        <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
         <CustomServiceCommand platform="ipfw">established</CustomServiceCommand>
         <CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
         <CustomServiceCommand platform="procurve_acl">established</CustomServiceCommand>
@@ -365,54 +365,54 @@
       </ServiceGroup>
       <ServiceGroup id="stdid13" name="Custom" comment="" ro="False">
         <CustomService id="id3B64EEA8" name="rpc" comment="works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"/>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfilter"/>
-          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m record_rpc</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
         <CustomService id="id3B64EF4E" name="irc-conn" comment="IRC connection tracker, supports DCC.&#10;Works on iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/&#10;" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"/>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfilter"/>
-          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m irc</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
         <CustomService id="id3B64EF50" name="psd" comment="Port scan detector, works only on iptables and  requires patch-o-matic &#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"/>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfilter"/>
-          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m psd --psd-weight-threshold 5 --psd-delay-threshold 10000</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
         <CustomService id="id3B64EF52" name="string" comment="Matches a string in a whole packet, works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"/>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfilter"/>
-          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m string --string test_pattern</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
         <CustomService id="id3B64EF54" name="talk" comment="Talk protocol support. Works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"/>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfilter"/>
-          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m talk</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
       </ServiceGroup>
       <ServiceGroup id="stdid19" name="TagServices" comment="" ro="False"/>
@@ -594,34 +594,34 @@
       <ServiceGroup id="id4511637123682" name="UDP" comment="" ro="False"/>
       <ServiceGroup id="id4511637223682" name="Custom" comment="" ro="False">
         <CustomService id="id4226X64279" name="dscp af11" comment="" ro="False" protocol="tcp" address_family="ipv4">
-          <CustomServiceCommand platform="fwsm"/>
+          <CustomServiceCommand platform="fwsm"></CustomServiceCommand>
           <CustomServiceCommand platform="iosacl">dscp af11</CustomServiceCommand>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfw"/>
-          <CustomServiceCommand platform="iptables"/>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
+          <CustomServiceCommand platform="iptables"></CustomServiceCommand>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
         <CustomService id="id8888X64279" name="esp dscp af12" comment="" ro="False" protocol="50" address_family="ipv4">
-          <CustomServiceCommand platform="fwsm"/>
+          <CustomServiceCommand platform="fwsm"></CustomServiceCommand>
           <CustomServiceCommand platform="iosacl">dscp af12</CustomServiceCommand>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfw"/>
-          <CustomServiceCommand platform="iptables"/>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
+          <CustomServiceCommand platform="iptables"></CustomServiceCommand>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
         <CustomService id="id26068X65694" name="esp dscp af11 ipv6" comment="" ro="False" protocol="50" address_family="ipv6">
-          <CustomServiceCommand platform="fwsm"/>
+          <CustomServiceCommand platform="fwsm"></CustomServiceCommand>
           <CustomServiceCommand platform="iosacl">dscp af11</CustomServiceCommand>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfw"/>
-          <CustomServiceCommand platform="iptables"/>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
+          <CustomServiceCommand platform="iptables"></CustomServiceCommand>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
       </ServiceGroup>
       <ServiceGroup id="id4511637323682" name="TagServices" comment="" ro="False"/>
@@ -650,11 +650,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4641623D29061" disabled="False" group="" log="True" position="1" action="Deny" direction="Both" comment="комментарий по-русски">
             <Src neg="False">
@@ -673,11 +671,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id46412C3326611" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -697,11 +693,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id46415A0129061" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -722,11 +716,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id25349X82668" disabled="False" group="" log="False" position="4" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -746,11 +738,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4641356226611" disabled="False" group="" log="False" position="5" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -770,11 +760,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4641359926611" disabled="False" group="" log="False" position="6" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -794,11 +782,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id46412F0326611" disabled="False" group="" log="False" position="7" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -818,11 +804,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4641357426611" disabled="False" group="" log="False" position="8" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -842,11 +826,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4641358626611" disabled="False" group="" log="False" position="9" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -866,11 +848,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4641456D29061" disabled="False" group="" log="False" position="10" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -890,11 +870,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4641457E29061" disabled="False" group="" log="False" position="11" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -914,11 +892,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4641458F29061" disabled="False" group="" log="False" position="12" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -938,11 +914,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id464147C929061" disabled="False" group="" log="False" position="13" action="Accept" direction="Both" comment="interface ethernet1 has address on network 10.10.10.0/24,&#10;therefore net-10.10.10 is behind the router and we do&#10;not need to put rules 12-18 in outbound acl of eth0">
             <Src neg="False">
@@ -962,11 +936,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id46414A3E29061" disabled="False" group="" log="False" position="14" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -986,11 +958,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id46414A4F29061" disabled="False" group="" log="False" position="15" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -1010,11 +980,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id46414A6029061" disabled="False" group="" log="False" position="16" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -1034,11 +1002,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id46414CEB29061" disabled="False" group="" log="False" position="17" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -1058,11 +1024,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4641521829061" disabled="False" group="" log="False" position="18" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -1082,11 +1046,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id46415F6729061" disabled="False" group="" log="False" position="19" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -1106,11 +1068,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id5377X64279" disabled="False" group="" log="False" position="20" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -1130,11 +1090,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#7694C0</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id8889X64279" disabled="False" group="" log="False" position="21" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -1154,11 +1112,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#7694C0</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id46412C2726611" disabled="False" group="" log="True" position="22" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -1177,11 +1133,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -1209,10 +1163,10 @@
           <Option name="accept_established">true</Option>
           <Option name="accept_new_tcp_with_no_syn">true</Option>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
-          <Option name="compiler"/>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">true</Option>
           <Option name="eliminate_duplicates">true</Option>
           <Option name="filesystem">/etc</Option>
@@ -1241,8 +1195,8 @@
           <Option name="iosacl_logging_trap_level">3</Option>
           <Option name="iosacl_prolog_script">! This is prolog</Option>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"/>
-          <Option name="iosacl_syslog_host"/>
+          <Option name="iosacl_syslog_facility"></Option>
+          <Option name="iosacl_syslog_host"></Option>
           <Option name="iosacl_use_acl_remarks">False</Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
           <Option name="limit_value">0</Option>
@@ -1257,7 +1211,7 @@
           <Option name="mgmt_addr">1.1.1.100</Option>
           <Option name="mgmt_ssh">True</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">false</Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
@@ -1278,9 +1232,9 @@
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
-          <Option name="scpArgs"/>
+          <Option name="scpArgs"></Option>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="use_scp">False</Option>
           <Option name="verify_interfaces">true</Option>
@@ -1309,11 +1263,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id464131F726611" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -1333,11 +1285,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id464137AA26611" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -1357,11 +1307,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4641379926611" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -1381,11 +1329,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4641378826611" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -1405,11 +1351,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4641377726611" disabled="False" group="" log="False" position="5" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -1429,11 +1373,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id152F20845" disabled="False" group="" log="False" position="6" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -1452,11 +1394,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id152220845" disabled="False" group="" log="False" position="7" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -1475,11 +1415,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id153D20845" disabled="False" group="" log="False" position="8" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -1498,11 +1436,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id154B20845" disabled="False" group="" log="False" position="9" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -1522,11 +1458,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id7427X44763" disabled="False" group="" log="False" position="10" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -1548,11 +1482,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id7456X44763" disabled="False" group="" log="False" position="11" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -1571,11 +1503,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id85935X7744" disabled="False" group="" log="False" position="12" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -1595,11 +1525,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id85953X7744" disabled="False" group="" log="False" position="13" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -1620,11 +1548,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id85970X7744" disabled="False" group="" log="False" position="14" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -1644,11 +1570,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id7439X44763" disabled="False" group="" log="False" position="15" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -1667,11 +1591,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4641320326611" disabled="False" group="" log="True" position="16" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -1690,11 +1612,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -1718,10 +1638,10 @@
           <Option name="accept_established">true</Option>
           <Option name="accept_new_tcp_with_no_syn">true</Option>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
-          <Option name="compiler"/>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">true</Option>
           <Option name="eliminate_duplicates">true</Option>
           <Option name="firewall_dir">/etc</Option>
@@ -1734,21 +1654,21 @@
           <Option name="iosacl_acl_basic">True</Option>
           <Option name="iosacl_acl_no_clear">False</Option>
           <Option name="iosacl_acl_substitution">False</Option>
-          <Option name="iosacl_acl_temp_addr"/>
+          <Option name="iosacl_acl_temp_addr"></Option>
           <Option name="iosacl_add_clear_statements">true</Option>
           <Option name="iosacl_assume_fw_part_of_any">true</Option>
-          <Option name="iosacl_epilog_script"/>
+          <Option name="iosacl_epilog_script"></Option>
           <Option name="iosacl_include_comments">True</Option>
           <Option name="iosacl_logging_buffered">False</Option>
-          <Option name="iosacl_logging_buffered_level"/>
+          <Option name="iosacl_logging_buffered_level"></Option>
           <Option name="iosacl_logging_console">False</Option>
-          <Option name="iosacl_logging_console_level"/>
+          <Option name="iosacl_logging_console_level"></Option>
           <Option name="iosacl_logging_timestamp">False</Option>
-          <Option name="iosacl_logging_trap_level"/>
-          <Option name="iosacl_prolog_script"/>
+          <Option name="iosacl_logging_trap_level"></Option>
+          <Option name="iosacl_prolog_script"></Option>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"/>
-          <Option name="iosacl_syslog_host"/>
+          <Option name="iosacl_syslog_facility"></Option>
+          <Option name="iosacl_syslog_host"></Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">1</Option>
           <Option name="load_modules">true</Option>
@@ -1758,10 +1678,10 @@
           <Option name="loopback_interface">lo0</Option>
           <Option name="macosx_ip_forward">1</Option>
           <Option name="manage_virtual_addr">true</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">false</Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
@@ -1783,7 +1703,7 @@
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="verify_interfaces">true</Option>
         </FirewallOptions>
@@ -1810,11 +1730,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id464264DF12807" disabled="False" group="" log="True" position="1" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -1833,11 +1751,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id464264EB12807" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -1857,11 +1773,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id464264F712807" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -1882,11 +1796,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4642650412807" disabled="False" group="" log="False" position="4" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -1906,11 +1818,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4642651012807" disabled="False" group="" log="False" position="5" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -1930,11 +1840,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4642651C12807" disabled="False" group="" log="False" position="6" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -1954,11 +1862,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4642652812807" disabled="False" group="" log="False" position="7" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -1978,11 +1884,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4642653412807" disabled="False" group="" log="False" position="8" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -2002,11 +1906,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4642654012807" disabled="False" group="" log="False" position="9" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2026,11 +1928,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4642654C12807" disabled="False" group="" log="False" position="10" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2050,11 +1950,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4642655812807" disabled="False" group="" log="False" position="11" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2074,11 +1972,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4642656412807" disabled="False" group="" log="False" position="12" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2098,11 +1994,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4642657012807" disabled="False" group="" log="False" position="13" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2122,11 +2016,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4642657C12807" disabled="False" group="" log="False" position="14" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2146,11 +2038,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4642658812807" disabled="False" group="" log="False" position="15" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2170,11 +2060,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4642659412807" disabled="False" group="" log="False" position="16" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2194,11 +2082,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id464265A012807" disabled="False" group="" log="False" position="17" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2218,11 +2104,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id464265AC12807" disabled="False" group="" log="False" position="18" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2242,11 +2126,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id464265B812807" disabled="False" group="" log="True" position="19" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -2265,11 +2147,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -2317,8 +2197,8 @@
           <Option name="accept_established">true</Option>
           <Option name="accept_new_tcp_with_no_syn">true</Option>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
           <Option name="configure_interfaces">true</Option>
           <Option name="eliminate_duplicates">true</Option>
@@ -2336,7 +2216,7 @@
           <Option name="iosacl_acl_temp_addr">10.10.10.0/24</Option>
           <Option name="iosacl_add_clear_statements">true</Option>
           <Option name="iosacl_assume_fw_part_of_any">true</Option>
-          <Option name="iosacl_epilog_script"/>
+          <Option name="iosacl_epilog_script"></Option>
           <Option name="iosacl_generate_logging_commands">False</Option>
           <Option name="iosacl_include_comments">True</Option>
           <Option name="iosacl_logging_buffered">False</Option>
@@ -2345,10 +2225,10 @@
           <Option name="iosacl_logging_console_level">3</Option>
           <Option name="iosacl_logging_timestamp">False</Option>
           <Option name="iosacl_logging_trap_level">3</Option>
-          <Option name="iosacl_prolog_script"/>
+          <Option name="iosacl_prolog_script"></Option>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"/>
-          <Option name="iosacl_syslog_host"/>
+          <Option name="iosacl_syslog_facility"></Option>
+          <Option name="iosacl_syslog_host"></Option>
           <Option name="iosacl_use_acl_remarks">False</Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
           <Option name="limit_value">0</Option>
@@ -2363,7 +2243,7 @@
           <Option name="mgmt_addr">10.10.10.0/24</Option>
           <Option name="mgmt_ssh">True</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">false</Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
@@ -2384,9 +2264,9 @@
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
-          <Option name="scpArgs"/>
+          <Option name="scpArgs"></Option>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="use_scp">False</Option>
           <Option name="verify_interfaces">true</Option>
@@ -2414,11 +2294,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id464C8AAD10931" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2437,11 +2315,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id464C8AA110931" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2460,11 +2336,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id46435A1C16989" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -2483,11 +2357,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4643662716989" disabled="False" group="" log="False" position="4" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -2506,11 +2378,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4643664116989" disabled="False" group="" log="False" position="5" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -2529,11 +2399,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4643663516989" disabled="False" group="" log="False" position="6" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -2552,11 +2420,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4254X38343" disabled="False" group="" log="False" position="7" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2575,11 +2441,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4341X97727" disabled="False" group="" log="False" position="8" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2600,11 +2464,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4268X38343" disabled="False" group="" log="False" position="9" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2623,11 +2485,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id5500X42946" disabled="False" group="" log="False" position="10" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2646,11 +2506,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id46435A1016989" disabled="True" group="" log="True" position="11" action="Deny" direction="Both" comment="disable this rule to make&#10;sure no outbound rules are&#10;generated for eth 1/1">
             <Src neg="False">
@@ -2669,11 +2527,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -2757,8 +2613,8 @@
           <Option name="accept_established">true</Option>
           <Option name="accept_new_tcp_with_no_syn">true</Option>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
           <Option name="configure_interfaces">true</Option>
           <Option name="eliminate_duplicates">true</Option>
@@ -2771,10 +2627,10 @@
           <Option name="iosacl_acl_basic">True</Option>
           <Option name="iosacl_acl_no_clear">False</Option>
           <Option name="iosacl_acl_substitution">False</Option>
-          <Option name="iosacl_acl_temp_addr"/>
+          <Option name="iosacl_acl_temp_addr"></Option>
           <Option name="iosacl_add_clear_statements">true</Option>
           <Option name="iosacl_assume_fw_part_of_any">true</Option>
-          <Option name="iosacl_epilog_script"/>
+          <Option name="iosacl_epilog_script"></Option>
           <Option name="iosacl_generate_logging_commands">True</Option>
           <Option name="iosacl_include_comments">True</Option>
           <Option name="iosacl_logging_buffered">True</Option>
@@ -2783,10 +2639,10 @@
           <Option name="iosacl_logging_console_level">6</Option>
           <Option name="iosacl_logging_timestamp">False</Option>
           <Option name="iosacl_logging_trap_level">3</Option>
-          <Option name="iosacl_prolog_script"/>
+          <Option name="iosacl_prolog_script"></Option>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"/>
-          <Option name="iosacl_syslog_host"/>
+          <Option name="iosacl_syslog_facility"></Option>
+          <Option name="iosacl_syslog_host"></Option>
           <Option name="iosacl_use_acl_remarks">True</Option>
           <Option name="iosacl_use_object_groups">False</Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
@@ -2802,7 +2658,7 @@
           <Option name="mgmt_addr">10.3.14.41</Option>
           <Option name="mgmt_ssh">True</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">false</Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
@@ -2823,9 +2679,9 @@
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
-          <Option name="scpArgs"/>
+          <Option name="scpArgs"></Option>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="use_scp">False</Option>
           <Option name="verify_interfaces">true</Option>
@@ -2853,11 +2709,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id28332X65694" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2877,11 +2731,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -2903,11 +2755,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id19137X65694" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2926,11 +2776,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id19165X65694" disabled="False" group="" log="True" position="2" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2949,11 +2797,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id19194X65694" disabled="False" group="" log="True" position="3" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2972,11 +2818,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id19226X65694" disabled="False" group="" log="True" position="4" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2995,11 +2839,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id19260X65694" disabled="False" group="" log="True" position="5" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -3018,11 +2860,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id19288X65694" disabled="False" group="" log="True" position="6" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -3041,11 +2881,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id19316X65694" disabled="False" group="" log="True" position="7" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -3064,11 +2902,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id19344X65694" disabled="False" group="" log="True" position="8" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -3087,11 +2923,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id19372X65694" disabled="False" group="" log="True" position="9" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -3110,11 +2944,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id19400X65694" disabled="False" group="" log="True" position="10" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -3133,11 +2965,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id24941X65694" disabled="False" group="" log="False" position="11" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -3157,11 +2987,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id7994X97727" disabled="False" group="" log="False" position="12" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -3180,11 +3008,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id9240X97727" disabled="False" group="" log="False" position="13" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -3207,11 +3033,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -3231,34 +3055,34 @@
         <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
-          <Option name="action_on_reject"/>
-          <Option name="activationCmd"/>
+          <Option name="action_on_reject"></Option>
+          <Option name="activationCmd"></Option>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">True</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="classify_mark_terminating">False</Option>
           <Option name="cmdline">-xt</Option>
-          <Option name="compiler"/>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="eliminate_duplicates">true</Option>
           <Option name="enable_ipv6">True</Option>
-          <Option name="epilog_script"/>
+          <Option name="epilog_script"></Option>
           <Option name="fallback_log">False</Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="freebsd_ip_forward">1</Option>
-          <Option name="freebsd_ip_redirect"/>
-          <Option name="freebsd_ip_sourceroute"/>
+          <Option name="freebsd_ip_redirect"></Option>
+          <Option name="freebsd_ip_sourceroute"></Option>
           <Option name="freebsd_ipv6_forward">1</Option>
-          <Option name="freebsd_path_ipf"/>
-          <Option name="freebsd_path_ipfw"/>
-          <Option name="freebsd_path_ipnat"/>
-          <Option name="freebsd_path_sysctl"/>
+          <Option name="freebsd_path_ipf"></Option>
+          <Option name="freebsd_path_ipfw"></Option>
+          <Option name="freebsd_path_ipnat"></Option>
+          <Option name="freebsd_path_sysctl"></Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="in_out_code">True</Option>
           <Option name="iosacl_acl_basic">False</Option>
@@ -3267,7 +3091,7 @@
           <Option name="iosacl_acl_temp_addr">fe80::21d:9ff:aaaa:bbbb</Option>
           <Option name="iosacl_add_clear_statements">true</Option>
           <Option name="iosacl_assume_fw_part_of_any">true</Option>
-          <Option name="iosacl_epilog_script"/>
+          <Option name="iosacl_epilog_script"></Option>
           <Option name="iosacl_generate_logging_commands">False</Option>
           <Option name="iosacl_include_comments">True</Option>
           <Option name="iosacl_logging_buffered">False</Option>
@@ -3276,13 +3100,13 @@
           <Option name="iosacl_logging_console_level">0</Option>
           <Option name="iosacl_logging_timestamp">False</Option>
           <Option name="iosacl_logging_trap_level">0</Option>
-          <Option name="iosacl_prolog_script"/>
+          <Option name="iosacl_prolog_script"></Option>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"/>
-          <Option name="iosacl_syslog_host"/>
-          <Option name="ipt_mangle_only_rulesets"/>
+          <Option name="iosacl_syslog_facility"></Option>
+          <Option name="iosacl_syslog_host"></Option>
+          <Option name="ipt_mangle_only_rulesets"></Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
-          <Option name="limit_suffix"/>
+          <Option name="limit_suffix"></Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">1</Option>
           <Option name="load_modules">True</Option>
@@ -3297,18 +3121,18 @@
           <Option name="loopback_interface">lo0</Option>
           <Option name="macosx_ip_forward">1</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modulate_state">False</Option>
           <Option name="no_ipv6_default_policy">False</Option>
-          <Option name="openbsd_ip_directed_broadcast"/>
+          <Option name="openbsd_ip_directed_broadcast"></Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="openbsd_ip_redirect"/>
-          <Option name="openbsd_ip_sourceroute"/>
+          <Option name="openbsd_ip_redirect"></Option>
+          <Option name="openbsd_ip_sourceroute"></Option>
           <Option name="openbsd_ipv6_forward">1</Option>
-          <Option name="openbsd_path_pfctl"/>
-          <Option name="openbsd_path_sysctl"/>
-          <Option name="output_file"/>
+          <Option name="openbsd_path_pfctl"></Option>
+          <Option name="openbsd_path_sysctl"></Option>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">False</Option>
           <Option name="pf_adaptive_end">0</Option>
           <Option name="pf_adaptive_start">0</Option>
@@ -3327,7 +3151,7 @@
           <Option name="pf_limit_states">10000</Option>
           <Option name="pf_limit_table_entries">0</Option>
           <Option name="pf_limit_tables">0</Option>
-          <Option name="pf_optimization"/>
+          <Option name="pf_optimization"></Option>
           <Option name="pf_other_first">0</Option>
           <Option name="pf_other_multiple">0</Option>
           <Option name="pf_other_single">0</Option>
@@ -3379,12 +3203,12 @@
           <Option name="pix_syslog_device_id_supported">false</Option>
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="prolog_place">fw_file</Option>
-          <Option name="prolog_script"/>
+          <Option name="prolog_script"></Option>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
-          <Option name="scpArgs"/>
+          <Option name="scpArgs"></Option>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -3416,11 +3240,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id10526X97727" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -3440,11 +3262,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -3466,11 +3286,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id10552X97727" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -3489,11 +3307,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id10564X97727" disabled="False" group="" log="True" position="2" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -3512,11 +3328,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id10576X97727" disabled="False" group="" log="True" position="3" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -3535,11 +3349,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id10588X97727" disabled="False" group="" log="True" position="4" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -3558,11 +3370,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id10600X97727" disabled="False" group="" log="True" position="5" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -3581,11 +3391,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id10612X97727" disabled="False" group="" log="True" position="6" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -3604,11 +3412,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id10624X97727" disabled="False" group="" log="True" position="7" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -3627,11 +3433,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id10636X97727" disabled="False" group="" log="True" position="8" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -3650,11 +3454,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id10648X97727" disabled="False" group="" log="True" position="9" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -3673,11 +3475,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id10660X97727" disabled="False" group="" log="True" position="10" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -3696,11 +3496,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id10672X97727" disabled="False" group="" log="False" position="11" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -3720,11 +3518,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id10685X97727" disabled="False" group="" log="False" position="12" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -3743,11 +3539,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id10697X97727" disabled="False" group="" log="False" position="13" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -3770,11 +3564,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -3794,34 +3586,34 @@
         <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
-          <Option name="action_on_reject"/>
-          <Option name="activationCmd"/>
+          <Option name="action_on_reject"></Option>
+          <Option name="activationCmd"></Option>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">True</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="classify_mark_terminating">False</Option>
           <Option name="cmdline">-xt</Option>
-          <Option name="compiler"/>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="eliminate_duplicates">true</Option>
           <Option name="enable_ipv6">True</Option>
-          <Option name="epilog_script"/>
+          <Option name="epilog_script"></Option>
           <Option name="fallback_log">False</Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="freebsd_ip_forward">1</Option>
-          <Option name="freebsd_ip_redirect"/>
-          <Option name="freebsd_ip_sourceroute"/>
+          <Option name="freebsd_ip_redirect"></Option>
+          <Option name="freebsd_ip_sourceroute"></Option>
           <Option name="freebsd_ipv6_forward">1</Option>
-          <Option name="freebsd_path_ipf"/>
-          <Option name="freebsd_path_ipfw"/>
-          <Option name="freebsd_path_ipnat"/>
-          <Option name="freebsd_path_sysctl"/>
+          <Option name="freebsd_path_ipf"></Option>
+          <Option name="freebsd_path_ipfw"></Option>
+          <Option name="freebsd_path_ipnat"></Option>
+          <Option name="freebsd_path_sysctl"></Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="in_out_code">True</Option>
           <Option name="iosacl_acl_basic">False</Option>
@@ -3830,7 +3622,7 @@
           <Option name="iosacl_acl_temp_addr">1.1.1.0/24</Option>
           <Option name="iosacl_add_clear_statements">true</Option>
           <Option name="iosacl_assume_fw_part_of_any">true</Option>
-          <Option name="iosacl_epilog_script"/>
+          <Option name="iosacl_epilog_script"></Option>
           <Option name="iosacl_generate_logging_commands">False</Option>
           <Option name="iosacl_include_comments">True</Option>
           <Option name="iosacl_logging_buffered">False</Option>
@@ -3839,13 +3631,13 @@
           <Option name="iosacl_logging_console_level">2</Option>
           <Option name="iosacl_logging_timestamp">False</Option>
           <Option name="iosacl_logging_trap_level">2</Option>
-          <Option name="iosacl_prolog_script"/>
+          <Option name="iosacl_prolog_script"></Option>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"/>
-          <Option name="iosacl_syslog_host"/>
-          <Option name="ipt_mangle_only_rulesets"/>
+          <Option name="iosacl_syslog_facility"></Option>
+          <Option name="iosacl_syslog_host"></Option>
+          <Option name="ipt_mangle_only_rulesets"></Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
-          <Option name="limit_suffix"/>
+          <Option name="limit_suffix"></Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">1</Option>
           <Option name="load_modules">True</Option>
@@ -3864,14 +3656,14 @@
           <Option name="mgmt_ssh">True</Option>
           <Option name="modulate_state">False</Option>
           <Option name="no_ipv6_default_policy">False</Option>
-          <Option name="openbsd_ip_directed_broadcast"/>
+          <Option name="openbsd_ip_directed_broadcast"></Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="openbsd_ip_redirect"/>
-          <Option name="openbsd_ip_sourceroute"/>
+          <Option name="openbsd_ip_redirect"></Option>
+          <Option name="openbsd_ip_sourceroute"></Option>
           <Option name="openbsd_ipv6_forward">1</Option>
-          <Option name="openbsd_path_pfctl"/>
-          <Option name="openbsd_path_sysctl"/>
-          <Option name="output_file"/>
+          <Option name="openbsd_path_pfctl"></Option>
+          <Option name="openbsd_path_sysctl"></Option>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">False</Option>
           <Option name="pf_adaptive_end">0</Option>
           <Option name="pf_adaptive_start">0</Option>
@@ -3890,7 +3682,7 @@
           <Option name="pf_limit_states">10000</Option>
           <Option name="pf_limit_table_entries">0</Option>
           <Option name="pf_limit_tables">0</Option>
-          <Option name="pf_optimization"/>
+          <Option name="pf_optimization"></Option>
           <Option name="pf_other_first">0</Option>
           <Option name="pf_other_multiple">0</Option>
           <Option name="pf_other_single">0</Option>
@@ -3942,12 +3734,12 @@
           <Option name="pix_syslog_device_id_supported">false</Option>
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="prolog_place">fw_file</Option>
-          <Option name="prolog_script"/>
+          <Option name="prolog_script"></Option>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
-          <Option name="scpArgs"/>
+          <Option name="scpArgs"></Option>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -3979,11 +3771,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4900X21941" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4005,11 +3795,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id15139X21941" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4029,11 +3817,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -4055,11 +3841,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4926X21941" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4078,11 +3862,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4938X21941" disabled="False" group="" log="True" position="2" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4101,11 +3883,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4950X21941" disabled="False" group="" log="True" position="3" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4124,11 +3904,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4962X21941" disabled="False" group="" log="True" position="4" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4147,11 +3925,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4974X21941" disabled="False" group="" log="True" position="5" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4170,11 +3946,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4986X21941" disabled="False" group="" log="True" position="6" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4193,11 +3967,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4998X21941" disabled="False" group="" log="True" position="7" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -4216,11 +3988,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id5010X21941" disabled="False" group="" log="True" position="8" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4239,11 +4009,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id5022X21941" disabled="False" group="" log="True" position="9" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4262,11 +4030,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id5034X21941" disabled="False" group="" log="True" position="10" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4285,11 +4051,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id5046X21941" disabled="False" group="" log="False" position="11" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4309,11 +4073,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id5059X21941" disabled="False" group="" log="False" position="12" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4332,11 +4094,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id5071X21941" disabled="False" group="" log="False" position="13" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4359,11 +4119,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -4387,34 +4145,34 @@
         <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
-          <Option name="action_on_reject"/>
-          <Option name="activationCmd"/>
+          <Option name="action_on_reject"></Option>
+          <Option name="activationCmd"></Option>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">True</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="classify_mark_terminating">False</Option>
           <Option name="cmdline">-xt</Option>
-          <Option name="compiler"/>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="eliminate_duplicates">true</Option>
           <Option name="enable_ipv6">True</Option>
-          <Option name="epilog_script"/>
+          <Option name="epilog_script"></Option>
           <Option name="fallback_log">False</Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="freebsd_ip_forward">1</Option>
-          <Option name="freebsd_ip_redirect"/>
-          <Option name="freebsd_ip_sourceroute"/>
+          <Option name="freebsd_ip_redirect"></Option>
+          <Option name="freebsd_ip_sourceroute"></Option>
           <Option name="freebsd_ipv6_forward">1</Option>
-          <Option name="freebsd_path_ipf"/>
-          <Option name="freebsd_path_ipfw"/>
-          <Option name="freebsd_path_ipnat"/>
-          <Option name="freebsd_path_sysctl"/>
+          <Option name="freebsd_path_ipf"></Option>
+          <Option name="freebsd_path_ipfw"></Option>
+          <Option name="freebsd_path_ipnat"></Option>
+          <Option name="freebsd_path_sysctl"></Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="in_out_code">True</Option>
           <Option name="iosacl_acl_basic">False</Option>
@@ -4423,7 +4181,7 @@
           <Option name="iosacl_acl_temp_addr">10.1.1.0</Option>
           <Option name="iosacl_add_clear_statements">true</Option>
           <Option name="iosacl_assume_fw_part_of_any">true</Option>
-          <Option name="iosacl_epilog_script"/>
+          <Option name="iosacl_epilog_script"></Option>
           <Option name="iosacl_generate_logging_commands">False</Option>
           <Option name="iosacl_include_comments">True</Option>
           <Option name="iosacl_logging_buffered">False</Option>
@@ -4432,13 +4190,13 @@
           <Option name="iosacl_logging_console_level">2</Option>
           <Option name="iosacl_logging_timestamp">False</Option>
           <Option name="iosacl_logging_trap_level">2</Option>
-          <Option name="iosacl_prolog_script"/>
+          <Option name="iosacl_prolog_script"></Option>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"/>
-          <Option name="iosacl_syslog_host"/>
-          <Option name="ipt_mangle_only_rulesets"/>
+          <Option name="iosacl_syslog_facility"></Option>
+          <Option name="iosacl_syslog_host"></Option>
+          <Option name="ipt_mangle_only_rulesets"></Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
-          <Option name="limit_suffix"/>
+          <Option name="limit_suffix"></Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">1</Option>
           <Option name="load_modules">True</Option>
@@ -4457,14 +4215,14 @@
           <Option name="mgmt_ssh">True</Option>
           <Option name="modulate_state">False</Option>
           <Option name="no_ipv6_default_policy">False</Option>
-          <Option name="openbsd_ip_directed_broadcast"/>
+          <Option name="openbsd_ip_directed_broadcast"></Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="openbsd_ip_redirect"/>
-          <Option name="openbsd_ip_sourceroute"/>
+          <Option name="openbsd_ip_redirect"></Option>
+          <Option name="openbsd_ip_sourceroute"></Option>
           <Option name="openbsd_ipv6_forward">1</Option>
-          <Option name="openbsd_path_pfctl"/>
-          <Option name="openbsd_path_sysctl"/>
-          <Option name="output_file"/>
+          <Option name="openbsd_path_pfctl"></Option>
+          <Option name="openbsd_path_sysctl"></Option>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">False</Option>
           <Option name="pf_adaptive_end">0</Option>
           <Option name="pf_adaptive_start">0</Option>
@@ -4483,7 +4241,7 @@
           <Option name="pf_limit_states">10000</Option>
           <Option name="pf_limit_table_entries">0</Option>
           <Option name="pf_limit_tables">0</Option>
-          <Option name="pf_optimization"/>
+          <Option name="pf_optimization"></Option>
           <Option name="pf_other_first">0</Option>
           <Option name="pf_other_multiple">0</Option>
           <Option name="pf_other_single">0</Option>
@@ -4535,12 +4293,12 @@
           <Option name="pix_syslog_device_id_supported">false</Option>
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="prolog_place">fw_file</Option>
-          <Option name="prolog_script"/>
+          <Option name="prolog_script"></Option>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
-          <Option name="scpArgs"/>
+          <Option name="scpArgs"></Option>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -4572,11 +4330,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id12152X53662" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4596,11 +4352,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -4622,11 +4376,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id12202X53662" disabled="False" group="" log="True" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4645,11 +4397,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -4672,11 +4422,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -4696,34 +4444,34 @@
         <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
-          <Option name="action_on_reject"/>
-          <Option name="activationCmd"/>
+          <Option name="action_on_reject"></Option>
+          <Option name="activationCmd"></Option>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">True</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="classify_mark_terminating">False</Option>
           <Option name="cmdline">-xt</Option>
-          <Option name="compiler"/>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="eliminate_duplicates">true</Option>
           <Option name="enable_ipv6">True</Option>
-          <Option name="epilog_script"/>
+          <Option name="epilog_script"></Option>
           <Option name="fallback_log">False</Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="freebsd_ip_forward">1</Option>
-          <Option name="freebsd_ip_redirect"/>
-          <Option name="freebsd_ip_sourceroute"/>
+          <Option name="freebsd_ip_redirect"></Option>
+          <Option name="freebsd_ip_sourceroute"></Option>
           <Option name="freebsd_ipv6_forward">1</Option>
-          <Option name="freebsd_path_ipf"/>
-          <Option name="freebsd_path_ipfw"/>
-          <Option name="freebsd_path_ipnat"/>
-          <Option name="freebsd_path_sysctl"/>
+          <Option name="freebsd_path_ipf"></Option>
+          <Option name="freebsd_path_ipfw"></Option>
+          <Option name="freebsd_path_ipnat"></Option>
+          <Option name="freebsd_path_sysctl"></Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="in_out_code">True</Option>
           <Option name="iosacl_acl_basic">False</Option>
@@ -4732,7 +4480,7 @@
           <Option name="iosacl_acl_temp_addr">fe80::21d:9ff:aaaa:bbbb/64</Option>
           <Option name="iosacl_add_clear_statements">true</Option>
           <Option name="iosacl_assume_fw_part_of_any">true</Option>
-          <Option name="iosacl_epilog_script"/>
+          <Option name="iosacl_epilog_script"></Option>
           <Option name="iosacl_generate_logging_commands">False</Option>
           <Option name="iosacl_include_comments">True</Option>
           <Option name="iosacl_logging_buffered">False</Option>
@@ -4741,13 +4489,13 @@
           <Option name="iosacl_logging_console_level">1</Option>
           <Option name="iosacl_logging_timestamp">False</Option>
           <Option name="iosacl_logging_trap_level">1</Option>
-          <Option name="iosacl_prolog_script"/>
+          <Option name="iosacl_prolog_script"></Option>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"/>
-          <Option name="iosacl_syslog_host"/>
-          <Option name="ipt_mangle_only_rulesets"/>
+          <Option name="iosacl_syslog_facility"></Option>
+          <Option name="iosacl_syslog_host"></Option>
+          <Option name="ipt_mangle_only_rulesets"></Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
-          <Option name="limit_suffix"/>
+          <Option name="limit_suffix"></Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">1</Option>
           <Option name="load_modules">True</Option>
@@ -4762,18 +4510,18 @@
           <Option name="loopback_interface">lo0</Option>
           <Option name="macosx_ip_forward">1</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modulate_state">False</Option>
           <Option name="no_ipv6_default_policy">False</Option>
-          <Option name="openbsd_ip_directed_broadcast"/>
+          <Option name="openbsd_ip_directed_broadcast"></Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="openbsd_ip_redirect"/>
-          <Option name="openbsd_ip_sourceroute"/>
+          <Option name="openbsd_ip_redirect"></Option>
+          <Option name="openbsd_ip_sourceroute"></Option>
           <Option name="openbsd_ipv6_forward">1</Option>
-          <Option name="openbsd_path_pfctl"/>
-          <Option name="openbsd_path_sysctl"/>
-          <Option name="output_file"/>
+          <Option name="openbsd_path_pfctl"></Option>
+          <Option name="openbsd_path_sysctl"></Option>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">False</Option>
           <Option name="pf_adaptive_end">0</Option>
           <Option name="pf_adaptive_start">0</Option>
@@ -4792,7 +4540,7 @@
           <Option name="pf_limit_states">10000</Option>
           <Option name="pf_limit_table_entries">0</Option>
           <Option name="pf_limit_tables">0</Option>
-          <Option name="pf_optimization"/>
+          <Option name="pf_optimization"></Option>
           <Option name="pf_other_first">0</Option>
           <Option name="pf_other_multiple">0</Option>
           <Option name="pf_other_single">0</Option>
@@ -4844,12 +4592,12 @@
           <Option name="pix_syslog_device_id_supported">false</Option>
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="prolog_place">fw_file</Option>
-          <Option name="prolog_script"/>
+          <Option name="prolog_script"></Option>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
-          <Option name="scpArgs"/>
+          <Option name="scpArgs"></Option>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -4882,11 +4630,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id66552X44763" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4906,11 +4652,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id66564X44763" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4930,11 +4674,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id66576X44763" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -4954,11 +4696,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id66588X44763" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -4978,11 +4718,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id66600X44763" disabled="False" group="" log="False" position="5" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -5002,11 +4740,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id66612X44763" disabled="False" group="" log="False" position="6" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -5025,11 +4761,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id66624X44763" disabled="False" group="" log="False" position="7" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -5048,11 +4782,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id66636X44763" disabled="False" group="" log="False" position="8" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -5071,11 +4803,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id66648X44763" disabled="False" group="" log="False" position="9" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -5095,11 +4825,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id66661X44763" disabled="False" group="" log="False" position="10" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -5121,11 +4849,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id66676X44763" disabled="False" group="" log="False" position="11" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -5144,11 +4870,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id66688X44763" disabled="False" group="" log="False" position="12" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -5167,11 +4891,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id66700X44763" disabled="False" group="" log="True" position="13" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -5190,11 +4912,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -5218,10 +4938,10 @@
           <Option name="accept_established">true</Option>
           <Option name="accept_new_tcp_with_no_syn">true</Option>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
-          <Option name="compiler"/>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">true</Option>
           <Option name="eliminate_duplicates">true</Option>
           <Option name="firewall_dir">/etc</Option>
@@ -5234,21 +4954,21 @@
           <Option name="iosacl_acl_basic">True</Option>
           <Option name="iosacl_acl_no_clear">False</Option>
           <Option name="iosacl_acl_substitution">False</Option>
-          <Option name="iosacl_acl_temp_addr"/>
+          <Option name="iosacl_acl_temp_addr"></Option>
           <Option name="iosacl_add_clear_statements">true</Option>
           <Option name="iosacl_assume_fw_part_of_any">true</Option>
-          <Option name="iosacl_epilog_script"/>
+          <Option name="iosacl_epilog_script"></Option>
           <Option name="iosacl_include_comments">True</Option>
           <Option name="iosacl_logging_buffered">False</Option>
-          <Option name="iosacl_logging_buffered_level"/>
+          <Option name="iosacl_logging_buffered_level"></Option>
           <Option name="iosacl_logging_console">False</Option>
-          <Option name="iosacl_logging_console_level"/>
+          <Option name="iosacl_logging_console_level"></Option>
           <Option name="iosacl_logging_timestamp">False</Option>
-          <Option name="iosacl_logging_trap_level"/>
-          <Option name="iosacl_prolog_script"/>
+          <Option name="iosacl_logging_trap_level"></Option>
+          <Option name="iosacl_prolog_script"></Option>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"/>
-          <Option name="iosacl_syslog_host"/>
+          <Option name="iosacl_syslog_facility"></Option>
+          <Option name="iosacl_syslog_host"></Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">1</Option>
           <Option name="load_modules">true</Option>
@@ -5258,10 +4978,10 @@
           <Option name="loopback_interface">lo0</Option>
           <Option name="macosx_ip_forward">1</Option>
           <Option name="manage_virtual_addr">true</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">false</Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
@@ -5283,7 +5003,7 @@
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="verify_interfaces">true</Option>
         </FirewallOptions>
@@ -5310,11 +5030,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id6652X9455" disabled="False" group="" log="True" position="1" action="Deny" direction="Outbound" comment="">
             <Src neg="False">
@@ -5333,11 +5051,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id6289X9455" disabled="False" group="" log="True" position="2" action="Deny" direction="Outbound" comment="">
             <Src neg="False">
@@ -5357,11 +5073,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id77882X9455" disabled="False" group="" log="True" position="3" action="Deny" direction="Outbound" comment="">
             <Src neg="False">
@@ -5380,11 +5094,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id6518X9455" disabled="False" group="" log="True" position="4" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -5403,11 +5115,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -5431,8 +5141,8 @@
           <Option name="accept_established">true</Option>
           <Option name="accept_new_tcp_with_no_syn">true</Option>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
           <Option name="configure_interfaces">true</Option>
           <Option name="eliminate_duplicates">true</Option>
@@ -5450,7 +5160,7 @@
           <Option name="iosacl_acl_temp_addr">10.10.10.0/24</Option>
           <Option name="iosacl_add_clear_statements">true</Option>
           <Option name="iosacl_assume_fw_part_of_any">true</Option>
-          <Option name="iosacl_epilog_script"/>
+          <Option name="iosacl_epilog_script"></Option>
           <Option name="iosacl_generate_logging_commands">False</Option>
           <Option name="iosacl_include_comments">True</Option>
           <Option name="iosacl_logging_buffered">False</Option>
@@ -5459,10 +5169,10 @@
           <Option name="iosacl_logging_console_level">3</Option>
           <Option name="iosacl_logging_timestamp">False</Option>
           <Option name="iosacl_logging_trap_level">3</Option>
-          <Option name="iosacl_prolog_script"/>
+          <Option name="iosacl_prolog_script"></Option>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"/>
-          <Option name="iosacl_syslog_host"/>
+          <Option name="iosacl_syslog_facility"></Option>
+          <Option name="iosacl_syslog_host"></Option>
           <Option name="iosacl_use_acl_remarks">False</Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
           <Option name="limit_value">0</Option>
@@ -5477,7 +5187,7 @@
           <Option name="mgmt_addr">10.10.10.0/24</Option>
           <Option name="mgmt_ssh">True</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">false</Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
@@ -5498,9 +5208,9 @@
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
-          <Option name="scpArgs"/>
+          <Option name="scpArgs"></Option>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="use_scp">False</Option>
           <Option name="verify_interfaces">true</Option>
@@ -5529,11 +5239,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="iosacl_add_mirror_rule">False</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id47192X84238" disabled="False" group="" log="True" position="1" action="Deny" direction="Outbound" comment="">
             <Src neg="False">
@@ -5552,11 +5260,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id47204X84238" disabled="False" group="" log="True" position="2" action="Deny" direction="Outbound" comment="">
             <Src neg="False">
@@ -5576,11 +5282,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id47217X84238" disabled="False" group="" log="True" position="3" action="Deny" direction="Outbound" comment="">
             <Src neg="False">
@@ -5599,11 +5303,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id47229X84238" disabled="False" group="" log="True" position="4" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -5622,11 +5324,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -5650,8 +5350,8 @@
           <Option name="accept_established">true</Option>
           <Option name="accept_new_tcp_with_no_syn">true</Option>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
           <Option name="configure_interfaces">true</Option>
           <Option name="eliminate_duplicates">true</Option>
@@ -5669,7 +5369,7 @@
           <Option name="iosacl_acl_temp_addr">10.10.10.0/24</Option>
           <Option name="iosacl_add_clear_statements">true</Option>
           <Option name="iosacl_assume_fw_part_of_any">true</Option>
-          <Option name="iosacl_epilog_script"/>
+          <Option name="iosacl_epilog_script"></Option>
           <Option name="iosacl_generate_logging_commands">False</Option>
           <Option name="iosacl_include_comments">True</Option>
           <Option name="iosacl_logging_buffered">False</Option>
@@ -5678,10 +5378,10 @@
           <Option name="iosacl_logging_console_level">4</Option>
           <Option name="iosacl_logging_timestamp">False</Option>
           <Option name="iosacl_logging_trap_level">4</Option>
-          <Option name="iosacl_prolog_script"/>
+          <Option name="iosacl_prolog_script"></Option>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"/>
-          <Option name="iosacl_syslog_host"/>
+          <Option name="iosacl_syslog_facility"></Option>
+          <Option name="iosacl_syslog_host"></Option>
           <Option name="iosacl_use_acl_remarks">False</Option>
           <Option name="iosacl_use_object_groups">True</Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
@@ -5697,7 +5397,7 @@
           <Option name="mgmt_addr">10.10.10.0/24</Option>
           <Option name="mgmt_ssh">True</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">false</Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
@@ -5718,9 +5418,9 @@
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
-          <Option name="scpArgs"/>
+          <Option name="scpArgs"></Option>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="use_scp">False</Option>
           <Option name="verify_interfaces">true</Option>
@@ -5748,11 +5448,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id29216X37699" disabled="False" group="" log="False" position="1" action="Accept" direction="Inbound" comment="object-groups can not be used for ipv6">
             <Src neg="False">
@@ -5774,11 +5472,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id18740X37673" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -5800,11 +5496,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id18781X37673" disabled="False" group="" log="True" position="3" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -5825,11 +5519,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id18811X37673" disabled="False" group="" log="True" position="4" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -5850,11 +5542,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id18842X37673" disabled="False" group="" log="True" position="5" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -5875,11 +5565,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id18872X37673" disabled="False" group="" log="True" position="6" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -5901,11 +5589,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id18903X37673" disabled="False" group="" log="True" position="7" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -5927,11 +5613,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id18934X37673" disabled="False" group="" log="True" position="8" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -5952,11 +5636,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id18964X37673" disabled="False" group="" log="False" position="9" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -5975,11 +5657,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id18992X37673" disabled="False" group="" log="False" position="10" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -5999,11 +5679,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id19021X37673" disabled="False" group="" log="True" position="11" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -6022,11 +5700,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id19049X37673" disabled="False" group="" log="False" position="12" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -6045,11 +5721,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -6068,18 +5742,18 @@
         </Management>
         <FirewallOptions>
           <Option name="admUser">vadim</Option>
-          <Option name="altAddress"/>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
-          <Option name="filesystem"/>
-          <Option name="firewall_dir"/>
+          <Option name="filesystem"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="iosacl_acl_basic">True</Option>
           <Option name="iosacl_acl_no_clear">False</Option>
           <Option name="iosacl_acl_substitution">False</Option>
-          <Option name="iosacl_acl_temp_addr"/>
+          <Option name="iosacl_acl_temp_addr"></Option>
           <Option name="iosacl_add_clear_statements">true</Option>
           <Option name="iosacl_assume_fw_part_of_any">true</Option>
-          <Option name="iosacl_epilog_script"/>
+          <Option name="iosacl_epilog_script"></Option>
           <Option name="iosacl_generate_logging_commands">False</Option>
           <Option name="iosacl_include_comments">True</Option>
           <Option name="iosacl_logging_buffered">False</Option>
@@ -6088,18 +5762,18 @@
           <Option name="iosacl_logging_console_level">4</Option>
           <Option name="iosacl_logging_timestamp">False</Option>
           <Option name="iosacl_logging_trap_level">4</Option>
-          <Option name="iosacl_prolog_script"/>
+          <Option name="iosacl_prolog_script"></Option>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"/>
-          <Option name="iosacl_syslog_host"/>
+          <Option name="iosacl_syslog_facility"></Option>
+          <Option name="iosacl_syslog_host"></Option>
           <Option name="iosacl_use_acl_remarks">False</Option>
           <Option name="iosacl_use_object_groups">True</Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
           <Option name="mgmt_addr">10.3.14.0/24</Option>
           <Option name="mgmt_ssh">True</Option>
-          <Option name="output_file"/>
-          <Option name="scpArgs"/>
-          <Option name="sshArgs"/>
+          <Option name="output_file"></Option>
+          <Option name="scpArgs"></Option>
+          <Option name="sshArgs"></Option>
           <Option name="use_scp">True</Option>
         </FirewallOptions>
       </Firewall>
@@ -6128,11 +5802,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="iosacl_add_mirror_rule">True</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id37596X78571" disabled="False" group="" log="False" position="1" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -6154,11 +5826,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="iosacl_add_mirror_rule">True</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id37546X78571" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -6180,11 +5850,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="iosacl_add_mirror_rule">True</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id37496X78571" disabled="False" group="" log="False" position="3" action="Deny" direction="Outbound" comment="">
             <Src neg="False">
@@ -6206,11 +5874,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="iosacl_add_mirror_rule">True</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id37446X78571" disabled="False" group="" log="False" position="4" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -6232,11 +5898,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="iosacl_add_mirror_rule">True</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id23007X79820" disabled="False" group="" log="False" position="5" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -6258,11 +5922,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="iosacl_add_mirror_rule">True</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id7118X77171" disabled="False" group="" log="False" position="6" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -6284,11 +5946,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="iosacl_add_mirror_rule">True</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id97562X78571" disabled="False" group="" log="False" position="7" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -6310,11 +5970,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="iosacl_add_mirror_rule">True</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id97670X78571" disabled="False" group="" log="False" position="8" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -6336,11 +5994,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="iosacl_add_mirror_rule">True</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id97620X78571" disabled="False" group="" log="False" position="9" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -6364,11 +6020,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="iosacl_add_mirror_rule">True</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id8137X79856" disabled="False" group="" log="False" position="10" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -6392,11 +6046,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="iosacl_add_mirror_rule">True</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id8203X79856" disabled="False" group="" log="False" position="11" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -6418,11 +6070,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="iosacl_add_mirror_rule">True</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id97720X78571" disabled="False" group="" log="False" position="12" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -6445,11 +6095,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="iosacl_add_mirror_rule">True</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id25166X82392" disabled="False" group="" log="False" position="13" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -6471,11 +6119,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="iosacl_add_mirror_rule">True</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -6499,8 +6145,8 @@
           <Option name="accept_established">true</Option>
           <Option name="accept_new_tcp_with_no_syn">true</Option>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
           <Option name="configure_interfaces">true</Option>
           <Option name="eliminate_duplicates">true</Option>
@@ -6518,7 +6164,7 @@
           <Option name="iosacl_acl_temp_addr">10.10.10.0/24</Option>
           <Option name="iosacl_add_clear_statements">true</Option>
           <Option name="iosacl_assume_fw_part_of_any">true</Option>
-          <Option name="iosacl_epilog_script"/>
+          <Option name="iosacl_epilog_script"></Option>
           <Option name="iosacl_generate_logging_commands">False</Option>
           <Option name="iosacl_include_comments">True</Option>
           <Option name="iosacl_logging_buffered">False</Option>
@@ -6527,10 +6173,10 @@
           <Option name="iosacl_logging_console_level">7</Option>
           <Option name="iosacl_logging_timestamp">False</Option>
           <Option name="iosacl_logging_trap_level">7</Option>
-          <Option name="iosacl_prolog_script"/>
+          <Option name="iosacl_prolog_script"></Option>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"/>
-          <Option name="iosacl_syslog_host"/>
+          <Option name="iosacl_syslog_facility"></Option>
+          <Option name="iosacl_syslog_host"></Option>
           <Option name="iosacl_use_acl_remarks">False</Option>
           <Option name="iosacl_use_object_groups">False</Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
@@ -6546,7 +6192,7 @@
           <Option name="mgmt_addr">10.10.10.0/24</Option>
           <Option name="mgmt_ssh">True</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">false</Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
@@ -6567,9 +6213,9 @@
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
-          <Option name="scpArgs"/>
+          <Option name="scpArgs"></Option>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="use_scp">False</Option>
           <Option name="verify_interfaces">true</Option>
@@ -6600,11 +6246,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="iosacl_add_mirror_rule">True</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id116013X79820" disabled="False" group="" log="False" position="1" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -6626,11 +6270,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="iosacl_add_mirror_rule">True</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id116027X79820" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -6652,11 +6294,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="iosacl_add_mirror_rule">True</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id116041X79820" disabled="False" group="" log="False" position="3" action="Deny" direction="Outbound" comment="">
             <Src neg="False">
@@ -6678,11 +6318,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="iosacl_add_mirror_rule">True</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id116055X79820" disabled="False" group="" log="False" position="4" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -6704,11 +6342,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="iosacl_add_mirror_rule">True</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id116069X79820" disabled="False" group="" log="False" position="5" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -6730,11 +6366,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="iosacl_add_mirror_rule">True</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id116083X79820" disabled="False" group="" log="False" position="6" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -6756,11 +6390,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="iosacl_add_mirror_rule">True</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id116097X79820" disabled="False" group="" log="False" position="7" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -6782,11 +6414,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="iosacl_add_mirror_rule">True</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id116111X79820" disabled="False" group="" log="False" position="8" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -6808,11 +6438,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="iosacl_add_mirror_rule">True</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id116125X79820" disabled="False" group="" log="False" position="9" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -6837,11 +6465,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="iosacl_add_mirror_rule">True</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id91496X81725" disabled="False" group="" log="False" position="10" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -6866,11 +6492,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="iosacl_add_mirror_rule">True</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id91445X81725" disabled="False" group="" log="False" position="11" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -6893,11 +6517,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="iosacl_add_mirror_rule">True</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id116141X79820" disabled="False" group="" log="False" position="12" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -6919,11 +6541,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="iosacl_add_mirror_rule">True</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -6947,8 +6567,8 @@
           <Option name="accept_established">true</Option>
           <Option name="accept_new_tcp_with_no_syn">true</Option>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
           <Option name="configure_interfaces">true</Option>
           <Option name="eliminate_duplicates">true</Option>
@@ -6966,7 +6586,7 @@
           <Option name="iosacl_acl_temp_addr">10.10.10.0/24</Option>
           <Option name="iosacl_add_clear_statements">true</Option>
           <Option name="iosacl_assume_fw_part_of_any">true</Option>
-          <Option name="iosacl_epilog_script"/>
+          <Option name="iosacl_epilog_script"></Option>
           <Option name="iosacl_generate_logging_commands">False</Option>
           <Option name="iosacl_include_comments">True</Option>
           <Option name="iosacl_logging_buffered">False</Option>
@@ -6975,10 +6595,10 @@
           <Option name="iosacl_logging_console_level">6</Option>
           <Option name="iosacl_logging_timestamp">False</Option>
           <Option name="iosacl_logging_trap_level">6</Option>
-          <Option name="iosacl_prolog_script"/>
+          <Option name="iosacl_prolog_script"></Option>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"/>
-          <Option name="iosacl_syslog_host"/>
+          <Option name="iosacl_syslog_facility"></Option>
+          <Option name="iosacl_syslog_host"></Option>
           <Option name="iosacl_use_acl_remarks">False</Option>
           <Option name="iosacl_use_object_groups">True</Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
@@ -6994,7 +6614,7 @@
           <Option name="mgmt_addr">10.10.10.0/24</Option>
           <Option name="mgmt_ssh">True</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">false</Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
@@ -7015,9 +6635,9 @@
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
-          <Option name="scpArgs"/>
+          <Option name="scpArgs"></Option>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="use_scp">False</Option>
           <Option name="verify_interfaces">true</Option>
@@ -7045,11 +6665,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id8341X83276" disabled="False" group="" log="True" position="1" action="Deny" direction="Both" comment="комментарий по-русски">
             <Src neg="False">
@@ -7068,11 +6686,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id8353X83276" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -7092,11 +6708,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id8365X83276" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -7117,11 +6731,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id8378X83276" disabled="False" group="" log="False" position="4" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -7141,11 +6753,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id8390X83276" disabled="False" group="" log="False" position="5" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -7165,11 +6775,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id8402X83276" disabled="False" group="" log="False" position="6" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -7189,11 +6797,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id8414X83276" disabled="False" group="" log="False" position="7" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -7213,11 +6819,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id8426X83276" disabled="False" group="" log="False" position="8" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -7237,11 +6841,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id8438X83276" disabled="False" group="" log="False" position="9" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -7261,11 +6863,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id8450X83276" disabled="False" group="" log="False" position="10" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -7285,11 +6885,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id8462X83276" disabled="False" group="" log="False" position="11" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -7309,11 +6907,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id8474X83276" disabled="False" group="" log="False" position="12" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -7333,11 +6929,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id8486X83276" disabled="False" group="" log="False" position="13" action="Accept" direction="Both" comment="interface ethernet1 has address on network 10.10.10.0/24,&#10;therefore net-10.10.10 is behind the router and we do&#10;not need to put rules 12-18 in outbound acl of eth0">
             <Src neg="False">
@@ -7357,11 +6951,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id8498X83276" disabled="False" group="" log="False" position="14" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -7381,11 +6973,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id8510X83276" disabled="False" group="" log="False" position="15" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -7405,11 +6995,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id8522X83276" disabled="False" group="" log="False" position="16" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -7429,11 +7017,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id8534X83276" disabled="False" group="" log="False" position="17" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -7453,11 +7039,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id8546X83276" disabled="False" group="" log="False" position="18" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -7477,11 +7061,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id8558X83276" disabled="False" group="" log="False" position="19" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -7501,11 +7083,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id8570X83276" disabled="False" group="" log="False" position="20" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -7525,11 +7105,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#7694C0</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id8582X83276" disabled="False" group="" log="False" position="21" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -7549,11 +7127,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#7694C0</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id8594X83276" disabled="False" group="" log="True" position="22" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -7572,11 +7148,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -7615,10 +7189,10 @@
           <Option name="accept_established">true</Option>
           <Option name="accept_new_tcp_with_no_syn">true</Option>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
-          <Option name="compiler"/>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">true</Option>
           <Option name="eliminate_duplicates">true</Option>
           <Option name="filesystem">/etc</Option>
@@ -7647,8 +7221,8 @@
           <Option name="iosacl_logging_trap_level">4</Option>
           <Option name="iosacl_prolog_script">! This is prolog</Option>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"/>
-          <Option name="iosacl_syslog_host"/>
+          <Option name="iosacl_syslog_facility"></Option>
+          <Option name="iosacl_syslog_host"></Option>
           <Option name="iosacl_use_acl_remarks">False</Option>
           <Option name="iosacl_use_object_groups">False</Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
@@ -7664,7 +7238,7 @@
           <Option name="mgmt_addr">1.1.1.100</Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">false</Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
@@ -7685,9 +7259,9 @@
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
-          <Option name="scpArgs"/>
+          <Option name="scpArgs"></Option>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="use_scp">False</Option>
           <Option name="verify_interfaces">true</Option>
@@ -7715,11 +7289,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id10193X32054" disabled="False" group="" log="False" position="1" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -7738,11 +7310,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id10221X32054" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -7761,11 +7331,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id10250X32054" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -7784,11 +7352,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id10279X32054" disabled="False" group="" log="False" position="4" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -7807,11 +7373,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -7833,11 +7397,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id10340X32054" disabled="False" group="" log="False" position="1" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -7856,11 +7418,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id10368X32054" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -7879,11 +7439,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id10397X32054" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -7902,11 +7460,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id10426X32054" disabled="False" group="" log="False" position="4" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -7925,11 +7481,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -7960,8 +7514,8 @@
           <Option name="accept_established">true</Option>
           <Option name="accept_new_tcp_with_no_syn">true</Option>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
           <Option name="configure_interfaces">true</Option>
           <Option name="eliminate_duplicates">true</Option>
@@ -7977,7 +7531,7 @@
           <Option name="iosacl_acl_temp_addr">192.168.1.1</Option>
           <Option name="iosacl_add_clear_statements">true</Option>
           <Option name="iosacl_assume_fw_part_of_any">true</Option>
-          <Option name="iosacl_epilog_script"/>
+          <Option name="iosacl_epilog_script"></Option>
           <Option name="iosacl_generate_logging_commands">False</Option>
           <Option name="iosacl_include_comments">True</Option>
           <Option name="iosacl_logging_buffered">False</Option>
@@ -7986,10 +7540,10 @@
           <Option name="iosacl_logging_console_level">0</Option>
           <Option name="iosacl_logging_timestamp">False</Option>
           <Option name="iosacl_logging_trap_level">0</Option>
-          <Option name="iosacl_prolog_script"/>
+          <Option name="iosacl_prolog_script"></Option>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"/>
-          <Option name="iosacl_syslog_host"/>
+          <Option name="iosacl_syslog_facility"></Option>
+          <Option name="iosacl_syslog_host"></Option>
           <Option name="iosacl_use_acl_remarks">False</Option>
           <Option name="iosacl_use_object_groups">False</Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
@@ -8002,10 +7556,10 @@
           <Option name="loopback_interface">lo0</Option>
           <Option name="macosx_ip_forward">1</Option>
           <Option name="manage_virtual_addr">true</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">false</Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
@@ -8026,9 +7580,9 @@
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
-          <Option name="scpArgs"/>
+          <Option name="scpArgs"></Option>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="use_scp">False</Option>
           <Option name="verify_interfaces">true</Option>
diff --git a/test/ipf/objects-for-regression-tests.fwb b/test/ipf/objects-for-regression-tests.fwb
index a679a1028..08d5f4caa 100644
--- a/test/ipf/objects-for-regression-tests.fwb
+++ b/test/ipf/objects-for-regression-tests.fwb
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
-<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="20" lastModified="1257363322" id="root">
+<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="21" lastModified="1257363322" id="root">
   <Library id="syslib000" color="#d4f8ff" name="Standard" comment="Standard objects" ro="True">
     <AnyNetwork id="sysid0" name="Any" comment="Any Network" ro="False" address="0.0.0.0" netmask="0.0.0.0"/>
     <AnyIPService id="sysid1" protocol_num="0" name="Any" comment="Any IP Service" ro="False"/>
@@ -51,9 +51,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -69,9 +69,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -100,17 +100,17 @@
     </ObjectGroup>
     <ServiceGroup id="stdid05" name="Services" comment="" ro="False">
       <CustomService id="stdid14_1" name="ESTABLISHED" comment="This service matches all packets which are part of network connections established through the firewall, or connections 'related' to those established through the firewall. Term 'established' refers to the state tracking mechanism which exists inside iptables and other stateful firewalls and does not mean any particular combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful inspection module made appropriate record in the state table. Usually stateful firewalls keep track of network connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' describes packet belonging to a separate network connection, related to the session firewall is keeping track of. One example is FTP command and FTP data sessions." ro="False" protocol="any" address_family="ipv4">
-        <CustomServiceCommand platform="Undefined"/>
+        <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
         <CustomServiceCommand platform="iosacl">established</CustomServiceCommand>
-        <CustomServiceCommand platform="ipfilter"/>
+        <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
         <CustomServiceCommand platform="ipfw">established</CustomServiceCommand>
         <CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
         <CustomServiceCommand platform="procurve_acl">established</CustomServiceCommand>
       </CustomService>
       <CustomService id="stdid14_2" name="ESTABLISHED ipv6" comment="This service matches all packets which are part of network connections established through the firewall, or connections 'related' to those established through the firewall. Term 'established' refers to the state tracking mechanism which exists inside iptables and other stateful firewalls and does not mean any particular combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful inspection module made appropriate record in the state table. Usually stateful firewalls keep track of network connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' describes packet belonging to a separate network connection, related to the session firewall is keeping track of. One example is FTP command and FTP data sessions." ro="False" protocol="any" address_family="ipv6">
-        <CustomServiceCommand platform="Undefined"/>
+        <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
         <CustomServiceCommand platform="iosacl">established</CustomServiceCommand>
-        <CustomServiceCommand platform="ipfilter"/>
+        <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
         <CustomServiceCommand platform="ipfw">established</CustomServiceCommand>
         <CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
         <CustomServiceCommand platform="procurve_acl">established</CustomServiceCommand>
@@ -353,54 +353,54 @@
       </ServiceGroup>
       <ServiceGroup id="stdid13" name="Custom" comment="" ro="False">
         <CustomService id="id3B64EEA8" name="rpc" comment="works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"/>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfilter"/>
-          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m record_rpc</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
         <CustomService id="id3B64EF4E" name="irc-conn" comment="IRC connection tracker, supports DCC.&#10;Works on iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/&#10;" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"/>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfilter"/>
-          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m irc</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
         <CustomService id="id3B64EF50" name="psd" comment="Port scan detector, works only on iptables and  requires patch-o-matic &#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"/>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfilter"/>
-          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m psd --psd-weight-threshold 5 --psd-delay-threshold 10000</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
         <CustomService id="id3B64EF52" name="string" comment="Matches a string in a whole packet, works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"/>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfilter"/>
-          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m string --string test_pattern</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
         <CustomService id="id3B64EF54" name="talk" comment="Talk protocol support. Works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"/>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfilter"/>
-          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m talk</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
       </ServiceGroup>
       <ServiceGroup id="stdid19" name="TagServices" comment="" ro="False"/>
@@ -548,9 +548,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -566,9 +566,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
@@ -583,9 +583,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -601,9 +601,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -658,9 +658,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr_filter">True</Option>
           </HostOptions>
         </Host>
@@ -735,9 +735,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -753,9 +753,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -771,9 +771,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">False</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -789,9 +789,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">False</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -807,9 +807,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">False</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -825,9 +825,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">False</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -843,9 +843,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">False</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -899,9 +899,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
@@ -1014,9 +1014,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
@@ -1118,8 +1118,8 @@
       </ServiceGroup>
       <ServiceGroup id="stdid13_1" name="Custom" comment="" ro="False">
         <CustomService id="id3B64FE22" name="talk" comment="Talk support" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"/>
-          <CustomServiceCommand platform="ipfilter"/>
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m ip_conntrack_talk -m ip_nat_talk</CustomServiceCommand>
         </CustomService>
       </ServiceGroup>
@@ -1128,7 +1128,7 @@
     <ObjectGroup id="stdid12_1" name="Firewalls" comment="" ro="False">
       <Firewall id="fw-firewall2" host_OS="freebsd" inactive="False" lastCompiled="1249841462" lastInstalled="0" lastModified="1263586644" platform="ipf" version="" name="firewall" comment="this is simple firewall with two interfaces. Test regular policy rules, including IP_fragments rule" ro="False">
         <NAT id="nat-firewall2" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="nat-firewall2-0" disabled="False" position="0" action="Translate" comment="comment : rule 0">
+          <NATRule id="nat-firewall2-0" disabled="False" group="" position="0" action="Translate" comment="comment : rule 0">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -1147,12 +1147,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="nat-firewall2-1" disabled="False" position="1" action="Translate" comment="">
+          <NATRule id="nat-firewall2-1" disabled="False" group="" position="1" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -1171,12 +1174,15 @@
             <TSrv neg="False">
               <ServiceRef ref="tcp-SMTP"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3CDB43B8" disabled="False" position="2" action="Translate" comment="">
+          <NATRule id="id3CDB43B8" disabled="False" group="" position="2" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -1195,12 +1201,15 @@
             <TSrv neg="False">
               <ServiceRef ref="id3B4FF09A"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D7581A7" disabled="False" position="3" action="Translate" comment="">
+          <NATRule id="id3D7581A7" disabled="False" group="" position="3" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -1220,12 +1229,15 @@
             <TSrv neg="False">
               <ServiceRef ref="id3B4FF09A"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D75843D" disabled="False" position="4" action="Translate" comment="">
+          <NATRule id="id3D75843D" disabled="False" group="" position="4" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -1245,15 +1257,18 @@
             <TSrv neg="False">
               <ServiceRef ref="id3B4FF09A"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
         </NAT>
         <Policy id="pol-firewall2" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id3B09D29D" disabled="False" log="True" position="0" action="Deny" direction="Inbound" comment="">
+          <PolicyRule id="id3B09D29D" disabled="False" group="" log="True" position="0" action="Deny" direction="Inbound" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1266,15 +1281,12 @@
             <Itf neg="False">
               <ObjectRef ref="if-FW-firewall2-eth1"/>
             </Itf>
-            
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="pol-firewall2-0" disabled="False" log="True" position="1" action="Deny" direction="Inbound" comment="Automatically generated rule blocking short fragments">
+          <PolicyRule id="pol-firewall2-0" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Automatically generated rule blocking short fragments">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1291,13 +1303,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="pol-firewall2-1" disabled="False" log="True" position="2" action="Deny" direction="Inbound" comment="Automatically generated anti-spoofing rule">
+          <PolicyRule id="pol-firewall2-1" disabled="False" group="" log="True" position="2" action="Deny" direction="Inbound" comment="Automatically generated anti-spoofing rule">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="fw-firewall2"/>
@@ -1315,13 +1325,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3EDC2CC7" disabled="False" log="False" position="3" action="Accept" direction="Inbound" comment="комментарий по-русски">
+          <PolicyRule id="id3EDC2CC7" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="комментарий по-русски">
             <Src neg="False">
               <ObjectRef ref="id3EDC2CF8"/>
             </Src>
@@ -1338,11 +1346,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B92DFC5" disabled="False" log="False" position="4" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3B92DFC5" disabled="False" group="" log="False" position="4" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -1355,13 +1362,11 @@
             <Itf neg="False">
               <ObjectRef ref="if-FW-firewall2-eth0"/>
             </Itf>
-            
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3C4E4C38" disabled="False" log="True" position="5" action="Deny" direction="Inbound" comment="">
+          <PolicyRule id="id3C4E4C38" disabled="False" group="" log="True" position="5" action="Deny" direction="Inbound" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1374,15 +1379,12 @@
             <Itf neg="False">
               <ObjectRef ref="if-FW-firewall2-eth0"/>
             </Itf>
-            
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B58E39D" disabled="False" log="True" position="6" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3B58E39D" disabled="False" group="" log="True" position="6" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1401,17 +1403,15 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"/>
-              <Option name="log_prefix"/>
+              <Option name="log_limit_suffix"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B6659FC" disabled="False" log="True" position="7" action="Reject" direction="Both" comment="">
+          <PolicyRule id="id3B6659FC" disabled="False" group="" log="True" position="7" action="Reject" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1431,16 +1431,14 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="ipf_keep_frags">False</Option>
               <Option name="ipf_return_icmp_as_dest">True</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3CE74D81" disabled="False" log="False" position="8" action="Reject" direction="Both" comment="">
+          <PolicyRule id="id3CE74D81" disabled="False" group="" log="False" position="8" action="Reject" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1457,13 +1455,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3BF1B45E" disabled="True" log="False" position="9" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3BF1B45E" disabled="True" group="" log="False" position="9" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id3BF1B3E1"/>
             </Src>
@@ -1480,16 +1476,14 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3BF1B44E" disabled="True" log="False" position="10" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3BF1B44E" disabled="True" group="" log="False" position="10" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id3BF1B3E7"/>
             </Src>
@@ -1506,16 +1500,14 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="pol-firewall2-3" disabled="False" log="False" position="11" action="Accept" direction="Both" comment="">
+          <PolicyRule id="pol-firewall2-3" disabled="False" group="" log="False" position="11" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="host-secondary1-com"/>
               <ObjectRef ref="host-secondary2-com"/>
@@ -1535,16 +1527,14 @@
               <IntervalRef ref="id3C63479E"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="pol-firewall2-2" disabled="False" log="False" position="12" action="Accept" direction="Both" comment="">
+          <PolicyRule id="pol-firewall2-2" disabled="False" group="" log="False" position="12" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1561,16 +1551,14 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="pol-firewall2-4" disabled="False" log="False" position="13" action="Accept" direction="Both" comment="">
+          <PolicyRule id="pol-firewall2-4" disabled="False" group="" log="False" position="13" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1588,16 +1576,14 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3CD8770E" disabled="False" log="False" position="14" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3CD8770E" disabled="False" group="" log="False" position="14" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1615,16 +1601,14 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3D98E652" disabled="False" log="False" position="15" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3D98E652" disabled="False" group="" log="False" position="15" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1642,16 +1626,14 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3CD87B1E" disabled="False" log="False" position="16" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3CD87B1E" disabled="False" group="" log="False" position="16" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1669,16 +1651,14 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B58E180" disabled="False" log="True" position="17" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3B58E180" disabled="False" group="" log="True" position="17" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="fw-firewall2"/>
             </Src>
@@ -1695,11 +1675,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3EE262C2" disabled="True" log="False" position="18" action="Accept" direction="Both" comment="illegal rule - firewall8 has dynamic interface">
+          <PolicyRule id="id3EE262C2" disabled="True" group="" log="False" position="18" action="Accept" direction="Both" comment="illegal rule - firewall8 has dynamic interface">
             <Src neg="False">
               <ObjectRef ref="fw-firewall2"/>
               <ObjectRef ref="id3D582236"/>
@@ -1718,11 +1697,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3EE261FB" disabled="False" log="False" position="19" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3EE261FB" disabled="False" group="" log="False" position="19" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="fw-firewall2"/>
               <ObjectRef ref="id3D58223F"/>
@@ -1743,11 +1721,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="pol-firewall2-5" disabled="False" log="False" position="20" action="Accept" direction="Both" comment="Automatically generated 'masquerading' rule">
+          <PolicyRule id="pol-firewall2-5" disabled="False" group="" log="False" position="20" action="Accept" direction="Both" comment="Automatically generated 'masquerading' rule">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="fw-firewall2"/>
@@ -1765,16 +1742,14 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="pol-firewall2-7" disabled="False" log="True" position="21" action="Deny" direction="Both" comment="Automatically generated 'catch all' rule">
+          <PolicyRule id="pol-firewall2-7" disabled="False" group="" log="True" position="21" action="Deny" direction="Both" comment="Automatically generated 'catch all' rule">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1791,20 +1766,18 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="ipf_keep_frags">False</Option>
               <Option name="ipf_log_facility">daemon</Option>
               <Option name="ipf_return_icmp_as_dest">False</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
               <Option name="log_level">alert</Option>
-              <Option name="log_limit_suffix"/>
-              <Option name="log_prefix"/>
+              <Option name="log_limit_suffix"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -1832,30 +1805,30 @@
           <Option name="accept_established">False</Option>
           <Option name="accept_new_tcp_with_no_syn">False</Option>
           <Option name="action_on_reject">ICMP port unreachable</Option>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="cmdline">-v</Option>
-          <Option name="compiler"/>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="dynAddr">False</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="eliminate_duplicates">True</Option>
-          <Option name="epilog_script"/>
-          <Option name="firewall_dir"/>
+          <Option name="epilog_script"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
-          <Option name="freebsd_path_ipf"/>
-          <Option name="freebsd_path_ipnat"/>
-          <Option name="freebsd_path_sysctl"/>
+          <Option name="freebsd_path_ipf"></Option>
+          <Option name="freebsd_path_ipnat"></Option>
+          <Option name="freebsd_path_sysctl"></Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="ipf_conf_file_name_on_firewall">ipf.conf</Option>
           <Option name="ipf_log_body">False</Option>
           <Option name="ipf_log_facility">local0</Option>
@@ -1883,7 +1856,7 @@
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
@@ -1898,23 +1871,23 @@
           <Option name="openbsd_ip_redirect">0</Option>
           <Option name="openbsd_ip_sourceroute">0</Option>
           <Option name="optimize">True</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">False</Option>
           <Option name="platform">iptables</Option>
-          <Option name="prolog_script"/>
-          <Option name="scpArgs"/>
-          <Option name="script_env_path"/>
+          <Option name="prolog_script"></Option>
+          <Option name="scpArgs"></Option>
+          <Option name="script_env_path"></Option>
           <Option name="script_name_on_firewall">ipf.fw</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
-          <Option name="sshArgs"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
+          <Option name="sshArgs"></Option>
           <Option name="use_numeric_log_levels">False</Option>
         </FirewallOptions>
       </Firewall>
       <Firewall id="id3AF5AA0A" host_OS="freebsd" inactive="False" lastCompiled="1249841494" lastInstalled="0" lastModified="1249841490" platform="ipf" version="" name="firewall1" comment="this object is used to test all kinds of negation in policy rules&#10;&#10;Currently negation in NAT is not supported for ipf, therefore all rules in NAT with&#10;negation are disabled&#10;" ro="False">
         <NAT id="id3AF5AA0D" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id3C98491C" disabled="True" position="0" action="Translate" comment="">
+          <NATRule id="id3C98491C" disabled="True" group="" position="0" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -1933,12 +1906,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3AFADC09" disabled="False" position="1" action="Translate" comment="">
+          <NATRule id="id3AFADC09" disabled="False" group="" position="1" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="host-hostA"/>
             </OSrc>
@@ -1957,12 +1933,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3CD23959" disabled="True" position="2" action="Translate" comment="">
+          <NATRule id="id3CD23959" disabled="True" group="" position="2" action="Translate" comment="">
             <OSrc neg="True">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -1981,12 +1960,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3B1328FB" disabled="False" position="3" action="Translate" comment="">
+          <NATRule id="id3B1328FB" disabled="False" group="" position="3" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2005,12 +1987,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3E7ABF0A" disabled="False" position="4" action="Translate" comment="">
+          <NATRule id="id3E7ABF0A" disabled="False" group="" position="4" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2030,12 +2015,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3AF5AAD3" disabled="True" position="5" action="Translate" comment="">
+          <NATRule id="id3AF5AAD3" disabled="True" group="" position="5" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2054,12 +2042,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3CCA1B57" disabled="True" position="6" action="Translate" comment="">
+          <NATRule id="id3CCA1B57" disabled="True" group="" position="6" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2078,12 +2069,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3B50F7CB" disabled="True" position="7" action="Translate" comment="">
+          <NATRule id="id3B50F7CB" disabled="True" group="" position="7" action="Translate" comment="">
             <OSrc neg="True">
               <ObjectRef ref="id3B022266"/>
             </OSrc>
@@ -2102,12 +2096,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3BD8D94B" disabled="True" position="8" action="Translate" comment="">
+          <NATRule id="id3BD8D94B" disabled="True" group="" position="8" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2126,12 +2123,15 @@
             <TSrv neg="False">
               <ServiceRef ref="id3B5009F7"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3BD8D9DD" disabled="True" position="9" action="Translate" comment="">
+          <NATRule id="id3BD8D9DD" disabled="True" group="" position="9" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2150,12 +2150,15 @@
             <TSrv neg="False">
               <ServiceRef ref="id3B5009F7"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3BBC0EA4" disabled="True" position="10" action="Translate" comment="">
+          <NATRule id="id3BBC0EA4" disabled="True" group="" position="10" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="id3B4572AF"/>
             </OSrc>
@@ -2174,12 +2177,15 @@
             <TSrv neg="False">
               <ServiceRef ref="id3B5009F7"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3BBC0F93" disabled="True" position="11" action="Translate" comment="">
+          <NATRule id="id3BBC0F93" disabled="True" group="" position="11" action="Translate" comment="">
             <OSrc neg="True">
               <ObjectRef ref="id3B4572AF"/>
             </OSrc>
@@ -2198,12 +2204,15 @@
             <TSrv neg="False">
               <ServiceRef ref="id3B5009F7"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3BC6BCE5" disabled="True" position="12" action="Translate" comment="">
+          <NATRule id="id3BC6BCE5" disabled="True" group="" position="12" action="Translate" comment="">
             <OSrc neg="True">
               <ObjectRef ref="host-hostA"/>
             </OSrc>
@@ -2222,15 +2231,18 @@
             <TSrv neg="False">
               <ServiceRef ref="id3B5009F7"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
         </NAT>
         <Policy id="id3AF5AA0C" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id3C5987DC" disabled="False" log="True" position="0" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3C5987DC" disabled="False" group="" log="True" position="0" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id3B4572B5"/>
             </Src>
@@ -2243,15 +2255,12 @@
             <Itf neg="False">
               <ObjectRef ref="id3AF5AA96"/>
             </Itf>
-            
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3CD34BEF" disabled="False" log="False" position="1" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3CD34BEF" disabled="False" group="" log="False" position="1" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id3B4572AF"/>
             </Src>
@@ -2268,13 +2277,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AF5AAB4" disabled="False" log="True" position="2" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
+          <PolicyRule id="id3AF5AAB4" disabled="False" group="" log="True" position="2" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3AF5AA0A"/>
@@ -2288,15 +2295,12 @@
             <Itf neg="False">
               <ObjectRef ref="id3AF5AA99"/>
             </Itf>
-            
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AF5AAAB" disabled="False" log="True" position="3" action="Deny" direction="Outbound" comment="Anti-spoofing rule">
+          <PolicyRule id="id3AF5AAAB" disabled="False" group="" log="True" position="3" action="Deny" direction="Outbound" comment="Anti-spoofing rule">
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -2309,15 +2313,12 @@
             <Itf neg="False">
               <ObjectRef ref="id3AF5AA99"/>
             </Itf>
-            
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3CDDF2FA" disabled="False" log="False" position="4" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3CDDF2FA" disabled="False" group="" log="False" position="4" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -2334,11 +2335,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3CCA26E4" disabled="False" log="True" position="5" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3CCA26E4" disabled="False" group="" log="True" position="5" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -2355,13 +2355,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B9AB902" disabled="True" log="True" position="6" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3B9AB902" disabled="True" group="" log="True" position="6" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -2378,13 +2376,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AFC0F90" disabled="False" log="True" position="7" action="Accept" direction="Both" comment="hostF has the same IP address as firewal.">
+          <PolicyRule id="id3AFC0F90" disabled="False" group="" log="True" position="7" action="Accept" direction="Both" comment="hostF has the same IP address as firewal.">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -2401,11 +2397,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B021E10" disabled="False" log="True" position="8" action="Deny" direction="Both" comment="testing negation in the policy rule">
+          <PolicyRule id="id3B021E10" disabled="False" group="" log="True" position="8" action="Deny" direction="Both" comment="testing negation in the policy rule">
             <Src neg="True">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
@@ -2423,17 +2418,15 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="limit_suffix">/minute</Option>
               <Option name="limit_value">10</Option>
-              <Option name="log_prefix"/>
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B0B4A13" disabled="False" log="True" position="9" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3B0B4A13" disabled="False" group="" log="True" position="9" action="Deny" direction="Both" comment="">
             <Src neg="True">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
@@ -2451,13 +2444,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B5535B7" disabled="False" log="True" position="10" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3B5535B7" disabled="False" group="" log="True" position="10" action="Deny" direction="Both" comment="">
             <Src neg="True">
               <ObjectRef ref="id3B022266"/>
               <ObjectRef ref="id3AF5AA0A"/>
@@ -2475,13 +2466,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B11F63D" disabled="False" log="True" position="11" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3B11F63D" disabled="False" group="" log="True" position="11" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
@@ -2500,13 +2489,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3CDDF0AA" disabled="False" log="False" position="12" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3CDDF0AA" disabled="False" group="" log="False" position="12" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -2523,13 +2510,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B021E6F" disabled="True" log="True" position="13" action="Deny" direction="Both" comment="testing negation in service field">
+          <PolicyRule id="id3B021E6F" disabled="True" group="" log="True" position="13" action="Deny" direction="Both" comment="testing negation in service field">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -2548,13 +2533,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3CCA2CF4" disabled="True" log="True" position="14" action="Accept" direction="Both" comment="testing negation in service field">
+          <PolicyRule id="id3CCA2CF4" disabled="True" group="" log="True" position="14" action="Accept" direction="Both" comment="testing negation in service field">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -2573,11 +2556,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B45739A" disabled="False" log="True" position="15" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3B45739A" disabled="False" group="" log="True" position="15" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id3B4572B5"/>
             </Src>
@@ -2594,13 +2576,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AF5AAC8" disabled="False" log="False" position="16" action="Accept" direction="Both" comment="'masquerading' rule">
+          <PolicyRule id="id3AF5AAC8" disabled="False" group="" log="False" position="16" action="Accept" direction="Both" comment="'masquerading' rule">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -2617,11 +2597,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AF5AAE3" disabled="False" log="True" position="17" action="Deny" direction="Both" comment="'catch all' rule">
+          <PolicyRule id="id3AF5AAE3" disabled="False" group="" log="True" position="17" action="Deny" direction="Both" comment="'catch all' rule">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -2638,11 +2617,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -2678,34 +2655,34 @@
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">False</Option>
           <Option name="debug">False</Option>
           <Option name="dynAddr">False</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="eliminate_duplicates">True</Option>
-          <Option name="epilog_script"/>
-          <Option name="firewall_dir"/>
+          <Option name="epilog_script"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
-          <Option name="freebsd_path_ipf"/>
-          <Option name="freebsd_path_ipnat"/>
-          <Option name="freebsd_path_sysctl"/>
+          <Option name="freebsd_path_ipf"></Option>
+          <Option name="freebsd_path_ipnat"></Option>
+          <Option name="freebsd_path_sysctl"></Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="ipf_conf_file_name_on_firewall">/etc/fw/ipf.conf</Option>
           <Option name="ipf_log_body">False</Option>
-          <Option name="ipf_log_facility"/>
-          <Option name="ipf_log_level"/>
+          <Option name="ipf_log_facility"></Option>
+          <Option name="ipf_log_level"></Option>
           <Option name="ipf_log_or_block">False</Option>
           <Option name="ipf_nat_ekshell_proxy">False</Option>
           <Option name="ipf_nat_ftp_proxy">False</Option>
@@ -2729,36 +2706,36 @@
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modulate_state">False</Option>
           <Option name="nat_conf_file_name_on_firewall">/etc/fw/nat.conf</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
           <Option name="optimize">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">False</Option>
           <Option name="platform">iptables</Option>
-          <Option name="prolog_script"/>
+          <Option name="prolog_script"></Option>
           <Option name="proxy_arp">False</Option>
-          <Option name="scpArgs"/>
-          <Option name="script_env_path"/>
+          <Option name="scpArgs"></Option>
+          <Option name="script_env_path"></Option>
           <Option name="script_name_on_firewall">/etc/ipf.fw</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
-          <Option name="sshArgs"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
+          <Option name="sshArgs"></Option>
           <Option name="use_ip_tool">False</Option>
           <Option name="use_numeric_log_levels">False</Option>
         </FirewallOptions>
       </Firewall>
       <Firewall id="id3AFB66C6" host_OS="freebsd" inactive="False" lastCompiled="0" lastInstalled="0" lastModified="1257708838" platform="ipf" version="" name="firewall2" comment="this object has several interfaces and shows different rules for NAT. Also testing policy rule options " ro="False">
         <NAT id="id3AFB66C7" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id3AFB66C8" disabled="False" position="0" action="Translate" comment="">
+          <NATRule id="id3AFB66C8" disabled="False" group="" position="0" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2777,14 +2754,17 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule id="id3AFB66D6" disabled="False" position="1" action="Translate" comment="">
+          <NATRule id="id3AFB66D6" disabled="False" group="" position="1" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="id3B4572AF"/>
@@ -2804,14 +2784,17 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule id="id3DE9CA86" disabled="False" position="2" action="Translate" comment="">
+          <NATRule id="id3DE9CA86" disabled="False" group="" position="2" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2831,12 +2814,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3DE9CD88" disabled="False" position="3" action="Translate" comment="">
+          <NATRule id="id3DE9CD88" disabled="False" group="" position="3" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2855,12 +2841,15 @@
             <TSrv neg="False">
               <ServiceRef ref="tcp-SSH"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3DEA6375" disabled="False" position="4" action="Translate" comment="">
+          <NATRule id="id3DEA6375" disabled="False" group="" position="4" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2879,12 +2868,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3CABE6DF" disabled="False" position="5" action="Translate" comment="">
+          <NATRule id="id3CABE6DF" disabled="False" group="" position="5" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2904,12 +2896,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3E894DE7" disabled="True" position="6" action="Translate" comment="">
+          <NATRule id="id3E894DE7" disabled="True" group="" position="6" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2928,12 +2923,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3AFB69BD" disabled="False" position="7" action="Translate" comment="">
+          <NATRule id="id3AFB69BD" disabled="False" group="" position="7" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2953,12 +2951,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3DEA6769" disabled="False" position="8" action="Translate" comment="load balancing rule">
+          <NATRule id="id3DEA6769" disabled="False" group="" position="8" action="Translate" comment="load balancing rule">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2979,12 +2980,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3DEA8105" disabled="False" position="9" action="Translate" comment="load balancing rule">
+          <NATRule id="id3DEA8105" disabled="False" group="" position="9" action="Translate" comment="load balancing rule">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -3003,12 +3007,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D265545" disabled="False" position="10" action="Translate" comment="">
+          <NATRule id="id3D265545" disabled="False" group="" position="10" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -3027,12 +3034,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D265556" disabled="False" position="11" action="Translate" comment="">
+          <NATRule id="id3D265556" disabled="False" group="" position="11" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -3051,12 +3061,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3BEEF6D2" disabled="False" position="12" action="Translate" comment="">
+          <NATRule id="id3BEEF6D2" disabled="False" group="" position="12" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -3075,12 +3088,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3BD67563" disabled="False" position="13" action="Translate" comment="">
+          <NATRule id="id3BD67563" disabled="False" group="" position="13" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="host-hostB"/>
             </OSrc>
@@ -3099,14 +3115,17 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule id="id3BD6757E" disabled="True" position="14" action="Translate" comment="">
+          <NATRule id="id3BD6757E" disabled="True" group="" position="14" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -3125,12 +3144,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3B66568B" disabled="False" position="15" action="Translate" comment="NETMAP ">
+          <NATRule id="id3B66568B" disabled="False" group="" position="15" action="Translate" comment="NETMAP ">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -3149,12 +3171,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3B6656EF" disabled="True" position="16" action="Translate" comment="NETMAP">
+          <NATRule id="id3B6656EF" disabled="True" group="" position="16" action="Translate" comment="NETMAP">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -3173,12 +3198,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3AFB69F7" disabled="False" position="17" action="Translate" comment="">
+          <NATRule id="id3AFB69F7" disabled="False" group="" position="17" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -3197,12 +3225,15 @@
             <TSrv neg="False">
               <ServiceRef ref="id3B20468D"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3B7313C4" disabled="False" position="18" action="Translate" comment="">
+          <NATRule id="id3B7313C4" disabled="False" group="" position="18" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -3221,12 +3252,15 @@
             <TSrv neg="False">
               <ServiceRef ref="tcp-SMTP"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3DF6D103" disabled="False" position="19" action="Translate" comment="">
+          <NATRule id="id3DF6D103" disabled="False" group="" position="19" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -3245,12 +3279,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3DF6D242" disabled="False" position="20" action="Translate" comment="">
+          <NATRule id="id3DF6D242" disabled="False" group="" position="20" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -3270,12 +3307,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3F2E9A08" disabled="False" position="21" action="Translate" comment="">
+          <NATRule id="id3F2E9A08" disabled="False" group="" position="21" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -3294,12 +3334,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3F2E9B78" disabled="False" position="22" action="Translate" comment="">
+          <NATRule id="id3F2E9B78" disabled="False" group="" position="22" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -3318,12 +3361,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3F2E9CF2" disabled="False" position="23" action="Translate" comment="">
+          <NATRule id="id3F2E9CF2" disabled="False" group="" position="23" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -3342,15 +3388,18 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
         </NAT>
         <Policy id="id3AFB66E4" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id3AFB6708" disabled="False" log="True" position="0" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
+          <PolicyRule id="id3AFB6708" disabled="False" group="" log="True" position="0" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3AFB66C6"/>
@@ -3364,19 +3413,16 @@
             <Itf neg="False">
               <ObjectRef ref="id3AFB6706"/>
             </Itf>
-            
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
               <Option name="log_prefix">Iface: %I RULE %N -- %A **</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AFB6710" disabled="False" log="True" position="1" action="Deny" direction="Outbound" comment="Anti-spoofing rule">
+          <PolicyRule id="id3AFB6710" disabled="False" group="" log="True" position="1" action="Deny" direction="Outbound" comment="Anti-spoofing rule">
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3AFB66C6"/>
@@ -3390,19 +3436,16 @@
             <Itf neg="False">
               <ObjectRef ref="id3AFB6706"/>
             </Itf>
-            
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
               <Option name="log_prefix">Iface: %I RULE %N -- %A **</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AFB66E5" disabled="False" log="True" position="2" action="Deny" direction="Both" comment="block fragments">
+          <PolicyRule id="id3AFB66E5" disabled="False" group="" log="True" position="2" action="Deny" direction="Both" comment="block fragments">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3419,14 +3462,12 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B0C6FD2" disabled="False" log="True" position="3" action="Reject" direction="Both" comment="sends TCP RST and makes custom record in the log">
+          <PolicyRule id="id3B0C6FD2" disabled="False" group="" log="True" position="3" action="Reject" direction="Both" comment="sends TCP RST and makes custom record in the log">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3446,16 +3487,14 @@
               <Option name="action_on_reject">TCP RST</Option>
               <Option name="ipf_keep_frags">False</Option>
               <Option name="ipf_return_icmp_as_dest">False</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
               <Option name="log_prefix">IDENT</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3D333A66" disabled="False" log="True" position="4" action="Reject" direction="Both" comment="sends TCP RST and makes custom record in the log">
+          <PolicyRule id="id3D333A66" disabled="False" group="" log="True" position="4" action="Reject" direction="Both" comment="sends TCP RST and makes custom record in the log">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3472,19 +3511,17 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="ipf_keep_frags">False</Option>
               <Option name="ipf_return_icmp_as_dest">False</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
               <Option name="log_prefix">IDENT</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3D8FF63F" disabled="False" log="False" position="5" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3D8FF63F" disabled="False" group="" log="False" position="5" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id3B4572AF"/>
               <ObjectRef ref="id3D8FF5EC"/>
@@ -3502,11 +3539,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3D8FF660" disabled="False" log="False" position="6" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3D8FF660" disabled="False" group="" log="False" position="6" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id3B19C5EB"/>
             </Src>
@@ -3524,11 +3560,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AFB66EF" disabled="False" log="False" position="7" action="Accept" direction="Both" comment="'masquerading' rule">
+          <PolicyRule id="id3AFB66EF" disabled="False" group="" log="False" position="7" action="Accept" direction="Both" comment="'masquerading' rule">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -3545,13 +3580,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="id"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3C447B8D" disabled="False" log="True" position="8" action="Accept" direction="Both" comment="host-fw2 has the same address as &#10;        one of the firewall's interfaces">
+          <PolicyRule id="id3C447B8D" disabled="False" group="" log="True" position="8" action="Accept" direction="Both" comment="host-fw2 has the same address as &#10;        one of the firewall's interfaces">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3568,11 +3601,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3C447BCB" disabled="False" log="True" position="9" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3C447BCB" disabled="False" group="" log="True" position="9" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3589,11 +3621,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AFB66F9" disabled="False" log="True" position="10" action="Deny" direction="Both" comment="'catch all' rule">
+          <PolicyRule id="id3AFB66F9" disabled="False" group="" log="True" position="10" action="Deny" direction="Both" comment="'catch all' rule">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3610,12 +3641,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -3653,26 +3682,26 @@
           <Option name="action_on_reject">ICMP net unreachable</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="eliminate_duplicates">True</Option>
-          <Option name="firewall_dir"/>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
-          <Option name="freebsd_path_ipf"/>
-          <Option name="freebsd_path_ipnat"/>
-          <Option name="freebsd_path_sysctl"/>
-          <Option name="id"/>
+          <Option name="freebsd_path_ipf"></Option>
+          <Option name="freebsd_path_ipnat"></Option>
+          <Option name="freebsd_path_sysctl"></Option>
+          <Option name="id"></Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="ipf_log_body">False</Option>
-          <Option name="ipf_log_facility"/>
-          <Option name="ipf_log_level"/>
+          <Option name="ipf_log_facility"></Option>
+          <Option name="ipf_log_level"></Option>
           <Option name="ipf_log_or_block">False</Option>
           <Option name="ipf_nat_ftp_proxy">True</Option>
           <Option name="ipf_nat_h323_proxy">True</Option>
@@ -3708,17 +3737,17 @@
           <Option name="pf_return_icmp_as_dest">True</Option>
           <Option name="platform">iptables</Option>
           <Option name="proxy_arp">True</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="use_ip_tool">True</Option>
           <Option name="use_numeric_log_levels">False</Option>
         </FirewallOptions>
       </Firewall>
       <Firewall id="id3B0C6380" host_OS="freebsd" inactive="False" lastCompiled="1157929207" lastInstalled="0" lastModified="1270861562" platform="ipf" version="" name="firewall4" comment="this object is used to test a configuration where firewall has dynamic address " ro="False">
         <NAT id="id3B0C6381" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id3B0C6382" disabled="False" position="0" action="Translate" comment="">
+          <NATRule id="id3B0C6382" disabled="False" group="" position="0" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="host-hostA"/>
             </OSrc>
@@ -3737,14 +3766,17 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule id="id3D758531" disabled="False" position="1" action="Translate" comment="">
+          <NATRule id="id3D758531" disabled="False" group="" position="1" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="host-hostA"/>
             </OSrc>
@@ -3763,14 +3795,17 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule id="id3D75869D" disabled="False" position="2" action="Translate" comment="">
+          <NATRule id="id3D75869D" disabled="False" group="" position="2" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="host-hostA"/>
             </OSrc>
@@ -3789,14 +3824,17 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule id="id3D7586D1" disabled="False" position="3" action="Translate" comment="">
+          <NATRule id="id3D7586D1" disabled="False" group="" position="3" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="host-hostA"/>
             </OSrc>
@@ -3815,14 +3853,17 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule id="id3B0C6390" disabled="True" position="4" action="Translate" comment="negation in NAT is not supported&#10;in ipf yet">
+          <NATRule id="id3B0C6390" disabled="True" group="" position="4" action="Translate" comment="negation in NAT is not supported&#10;in ipf yet">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -3841,14 +3882,17 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule id="id3B202AFF" disabled="False" position="5" action="Translate" comment="">
+          <NATRule id="id3B202AFF" disabled="False" group="" position="5" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -3867,12 +3911,15 @@
             <TSrv neg="False">
               <ServiceRef ref="tcp-SSH"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D757CC5" disabled="False" position="6" action="Translate" comment="">
+          <NATRule id="id3D757CC5" disabled="False" group="" position="6" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -3892,12 +3939,15 @@
             <TSrv neg="False">
               <ServiceRef ref="id3B4FF09A"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D757E01" disabled="False" position="7" action="Translate" comment="">
+          <NATRule id="id3D757E01" disabled="False" group="" position="7" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -3917,12 +3967,15 @@
             <TSrv neg="False">
               <ServiceRef ref="id3B4FF09A"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D757F29" disabled="False" position="8" action="Translate" comment="">
+          <NATRule id="id3D757F29" disabled="False" group="" position="8" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -3942,12 +3995,15 @@
             <TSrv neg="False">
               <ServiceRef ref="id3B4FF09A"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3E798041" disabled="True" position="9" action="Translate" comment="">
+          <NATRule id="id3E798041" disabled="True" group="" position="9" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -3966,12 +4022,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id46CFC34328618" disabled="False" position="10" action="Translate" comment="">
+          <NATRule id="id46CFC34328618" disabled="False" group="" position="10" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -3990,9 +4049,12 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id32091X99989" disabled="False" group="" position="11" action="Translate" comment="">
@@ -4014,15 +4076,18 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
         </NAT>
         <Policy id="id3B0C639E" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id3B0C63E3" disabled="False" log="True" position="0" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
+          <PolicyRule id="id3B0C63E3" disabled="False" group="" log="True" position="0" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B0C6380"/>
@@ -4036,15 +4101,12 @@
             <Itf neg="False">
               <ObjectRef ref="id3B0C63E1"/>
             </Itf>
-            
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B0C63EB" disabled="False" log="True" position="1" action="Deny" direction="Outbound" comment="Anti-spoofing rule">
+          <PolicyRule id="id3B0C63EB" disabled="False" group="" log="True" position="1" action="Deny" direction="Outbound" comment="Anti-spoofing rule">
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B0C6380"/>
@@ -4058,15 +4120,12 @@
             <Itf neg="False">
               <ObjectRef ref="id3B0C63E1"/>
             </Itf>
-            
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B54C977" disabled="False" log="True" position="2" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3B54C977" disabled="False" group="" log="True" position="2" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4079,15 +4138,12 @@
             <Itf neg="False">
               <ObjectRef ref="id3B0C63E1"/>
             </Itf>
-            
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B54F071" disabled="False" log="True" position="3" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3B54F071" disabled="False" group="" log="True" position="3" action="Deny" direction="Both" comment="">
             <Src neg="True">
               <ObjectRef ref="id3B022266"/>
             </Src>
@@ -4100,15 +4156,12 @@
             <Itf neg="False">
               <ObjectRef ref="id3B0C63E1"/>
             </Itf>
-            
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B0C639F" disabled="False" log="True" position="4" action="Accept" direction="Both" comment="hostF has the same IP address as firewal.">
+          <PolicyRule id="id3B0C639F" disabled="False" group="" log="True" position="4" action="Accept" direction="Both" comment="hostF has the same IP address as firewal.">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4125,13 +4178,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="id"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B0C63A9" disabled="False" log="True" position="5" action="Deny" direction="Both" comment="testing negation in the policy rule">
+          <PolicyRule id="id3B0C63A9" disabled="False" group="" log="True" position="5" action="Deny" direction="Both" comment="testing negation in the policy rule">
             <Src neg="True">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
@@ -4149,14 +4200,12 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B0C63B4" disabled="False" log="True" position="6" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3B0C63B4" disabled="False" group="" log="True" position="6" action="Deny" direction="Both" comment="">
             <Src neg="True">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
@@ -4174,14 +4223,12 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B0C63BF" disabled="True" log="True" position="7" action="Deny" direction="Both" comment="testing negation in service field">
+          <PolicyRule id="id3B0C63BF" disabled="True" group="" log="True" position="7" action="Deny" direction="Both" comment="testing negation in service field">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4200,14 +4247,12 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B0C63CB" disabled="False" log="False" position="8" action="Accept" direction="Both" comment="'masquerading' rule">
+          <PolicyRule id="id3B0C63CB" disabled="False" group="" log="False" position="8" action="Accept" direction="Both" comment="'masquerading' rule">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -4224,13 +4269,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="id"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3D85069A" disabled="True" log="True" position="9" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3D85069A" disabled="True" group="" log="True" position="9" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4248,11 +4291,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B0C63D5" disabled="False" log="True" position="10" action="Deny" direction="Both" comment="'catch all' rule">
+          <PolicyRule id="id3B0C63D5" disabled="False" group="" log="True" position="10" action="Deny" direction="Both" comment="'catch all' rule">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4269,12 +4311,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -4310,34 +4350,34 @@
           <Option name="accept_established">False</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">False</Option>
           <Option name="debug">False</Option>
           <Option name="dynAddr">False</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="eliminate_duplicates">True</Option>
-          <Option name="epilog_script"/>
-          <Option name="firewall_dir"/>
+          <Option name="epilog_script"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="freebsd_path_ipf">/usr/sbin/ipf</Option>
           <Option name="freebsd_path_ipnat">/usr/sbin/ipnat</Option>
-          <Option name="freebsd_path_sysctl"/>
-          <Option name="id"/>
+          <Option name="freebsd_path_sysctl"></Option>
+          <Option name="id"></Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="ipf_log_body">False</Option>
-          <Option name="ipf_log_facility"/>
-          <Option name="ipf_log_level"/>
+          <Option name="ipf_log_facility"></Option>
+          <Option name="ipf_log_level"></Option>
           <Option name="ipf_log_or_block">False</Option>
           <Option name="ipf_nat_ftp_proxy">True</Option>
           <Option name="ipf_nat_h323_proxy">True</Option>
@@ -4358,26 +4398,26 @@
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modulate_state">False</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
           <Option name="optimize">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">False</Option>
           <Option name="platform">iptables</Option>
-          <Option name="prolog_script"/>
+          <Option name="prolog_script"></Option>
           <Option name="proxy_arp">False</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
-          <Option name="sshArgs"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
+          <Option name="sshArgs"></Option>
           <Option name="use_numeric_log_levels">False</Option>
         </FirewallOptions>
       </Firewall>
@@ -4386,7 +4426,7 @@
           <RuleSetOptions/>
         </NAT>
         <Policy id="id3C69BD51" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id3C69BDE1" disabled="False" log="True" position="0" action="Deny" direction="Inbound" comment="">
+          <PolicyRule id="id3C69BDE1" disabled="False" group="" log="True" position="0" action="Deny" direction="Inbound" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4403,13 +4443,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3CF5B373" disabled="False" log="True" position="1" action="Deny" direction="Inbound" comment="">
+          <PolicyRule id="id3CF5B373" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4426,13 +4464,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3C69BF13" disabled="False" log="False" position="2" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3C69BF13" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4449,9 +4485,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -4489,24 +4524,24 @@
           <Option name="action_on_reject">ICMP net unreachable</Option>
           <Option name="check_shading">True</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="eliminate_duplicates">True</Option>
-          <Option name="firewall_dir"/>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
-          <Option name="freebsd_path_ipf"/>
-          <Option name="freebsd_path_ipnat"/>
-          <Option name="freebsd_path_sysctl"/>
+          <Option name="freebsd_path_ipf"></Option>
+          <Option name="freebsd_path_ipnat"></Option>
+          <Option name="freebsd_path_sysctl"></Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="ipf_log_body">False</Option>
-          <Option name="ipf_log_facility"/>
-          <Option name="ipf_log_level"/>
+          <Option name="ipf_log_facility"></Option>
+          <Option name="ipf_log_level"></Option>
           <Option name="ipf_log_or_block">False</Option>
           <Option name="ipf_nat_ftp_proxy">False</Option>
           <Option name="ipf_nat_raudio_proxy">False</Option>
@@ -4523,7 +4558,7 @@
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
@@ -4533,10 +4568,10 @@
           <Option name="pass_all_out">False</Option>
           <Option name="platform">iptables</Option>
           <Option name="proxy_arp">False</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="use_ip_tool">False</Option>
           <Option name="use_numeric_log_levels">False</Option>
         </FirewallOptions>
@@ -4546,7 +4581,7 @@
           <RuleSetOptions/>
         </NAT>
         <Policy id="id3AF5A2BC" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id3BD8ECD0" disabled="False" log="True" position="0" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3BD8ECD0" disabled="False" group="" log="True" position="0" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id3AF5A2BA"/>
             </Src>
@@ -4559,13 +4594,11 @@
             <Itf neg="False">
               <ObjectRef ref="id3AF5A2CB"/>
             </Itf>
-            
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AFB70C7" disabled="False" log="False" position="1" action="Accept" direction="Inbound" comment="allow everything on loopback">
+          <PolicyRule id="id3AFB70C7" disabled="False" group="" log="False" position="1" action="Accept" direction="Inbound" comment="allow everything on loopback">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4578,13 +4611,11 @@
             <Itf neg="False">
               <ObjectRef ref="id3AFB7090"/>
             </Itf>
-            
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AFB70CF" disabled="False" log="False" position="2" action="Accept" direction="Outbound" comment="allow everything on loopback">
+          <PolicyRule id="id3AFB70CF" disabled="False" group="" log="False" position="2" action="Accept" direction="Outbound" comment="allow everything on loopback">
             <Src neg="False">
               <ObjectRef ref="id3AF5A2BA"/>
             </Src>
@@ -4597,13 +4628,11 @@
             <Itf neg="False">
               <ObjectRef ref="id3AFB7090"/>
             </Itf>
-            
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3BD8ECC6" disabled="False" log="True" position="3" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3BD8ECC6" disabled="False" group="" log="True" position="3" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id3AF5A2BA"/>
             </Src>
@@ -4616,13 +4645,11 @@
             <Itf neg="False">
               <ObjectRef ref="id3AFB7090"/>
             </Itf>
-            
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AF5A74B" disabled="False" log="True" position="4" action="Deny" direction="Both" comment="block fragments">
+          <PolicyRule id="id3AF5A74B" disabled="False" group="" log="True" position="4" action="Deny" direction="Both" comment="block fragments">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4639,13 +4666,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AF5A73A" disabled="False" log="False" position="5" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3AF5A73A" disabled="False" group="" log="False" position="5" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4667,11 +4692,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AF5A757" disabled="False" log="False" position="6" action="Accept" direction="Both" comment="allow all outgoing connections">
+          <PolicyRule id="id3AF5A757" disabled="False" group="" log="False" position="6" action="Accept" direction="Both" comment="allow all outgoing connections">
             <Src neg="False">
               <ObjectRef ref="id3AF5A2BA"/>
             </Src>
@@ -4688,11 +4712,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AF5A762" disabled="False" log="True" position="7" action="Deny" direction="Both" comment="'catch all' rule">
+          <PolicyRule id="id3AF5A762" disabled="False" group="" log="True" position="7" action="Deny" direction="Both" comment="'catch all' rule">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4709,11 +4732,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -4739,23 +4760,23 @@
           <Option name="action_on_reject">ICMP host prohibited</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="firewall_dir"/>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
-          <Option name="freebsd_path_ipf"/>
-          <Option name="freebsd_path_ipnat"/>
-          <Option name="freebsd_path_sysctl"/>
+          <Option name="freebsd_path_ipf"></Option>
+          <Option name="freebsd_path_ipnat"></Option>
+          <Option name="freebsd_path_sysctl"></Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="ipf_log_body">False</Option>
-          <Option name="ipf_log_facility"/>
-          <Option name="ipf_log_level"/>
+          <Option name="ipf_log_facility"></Option>
+          <Option name="ipf_log_level"></Option>
           <Option name="ipf_log_or_block">False</Option>
           <Option name="ipf_nat_ftp_proxy">False</Option>
           <Option name="ipf_nat_raudio_proxy">False</Option>
@@ -4770,9 +4791,9 @@
           <Option name="log_all_dropped">False</Option>
           <Option name="log_ip_opt">False</Option>
           <Option name="log_level">debug</Option>
-          <Option name="log_limit_suffix"/>
+          <Option name="log_limit_suffix"></Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">False</Option>
@@ -4781,17 +4802,17 @@
           <Option name="no_optimisation">False</Option>
           <Option name="pass_all_out">False</Option>
           <Option name="platform">iptables</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="use_ip_tool">False</Option>
           <Option name="use_numeric_log_levels">False</Option>
         </FirewallOptions>
       </Firewall>
       <Firewall id="id3D582236" host_OS="freebsd" lastCompiled="1157929212" lastInstalled="0" lastModified="0" platform="ipf" name="firewall8" comment="" ro="False">
         <NAT id="id3D58223A" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id3D58237B" disabled="False" position="0" action="Translate" comment="">
+          <NATRule id="id3D58237B" disabled="False" group="" position="0" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -4810,12 +4831,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D5823A5" disabled="False" position="1" action="Translate" comment="">
+          <NATRule id="id3D5823A5" disabled="False" group="" position="1" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -4834,12 +4858,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D5823B9" disabled="False" position="2" action="Translate" comment="">
+          <NATRule id="id3D5823B9" disabled="False" group="" position="2" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -4858,12 +4885,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D58245E" disabled="False" position="3" action="Translate" comment="">
+          <NATRule id="id3D58245E" disabled="False" group="" position="3" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4882,12 +4912,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D58236D" disabled="False" position="4" action="Translate" comment="">
+          <NATRule id="id3D58236D" disabled="False" group="" position="4" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4906,12 +4939,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D58235F" disabled="False" position="5" action="Translate" comment="">
+          <NATRule id="id3D58235F" disabled="False" group="" position="5" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4930,12 +4966,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D582472" disabled="False" position="6" action="Translate" comment="">
+          <NATRule id="id3D582472" disabled="False" group="" position="6" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4954,12 +4993,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D58249D" disabled="False" position="7" action="Translate" comment="">
+          <NATRule id="id3D58249D" disabled="False" group="" position="7" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4978,12 +5020,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D5825CC" disabled="False" position="8" action="Translate" comment="">
+          <NATRule id="id3D5825CC" disabled="False" group="" position="8" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -5002,15 +5047,18 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
         </NAT>
         <Policy id="id3D582239" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id3D5822AA" disabled="False" log="False" position="0" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3D5822AA" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5027,11 +5075,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3D5822B5" disabled="False" log="False" position="1" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3D5822B5" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5048,11 +5095,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3D582294" disabled="False" log="False" position="2" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3D582294" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5069,11 +5115,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3D58228A" disabled="False" log="False" position="3" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3D58228A" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5090,11 +5135,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3D5822A0" disabled="False" log="True" position="4" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3D5822A0" disabled="False" group="" log="True" position="4" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5111,11 +5155,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -5146,20 +5188,20 @@
         <FirewallOptions>
           <Option name="action_on_reject">ICMP host prohibited</Option>
           <Option name="check_shading">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="debug">False</Option>
           <Option name="eliminate_duplicates">True</Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="freebsd_ip_forward">1</Option>
-          <Option name="freebsd_path_ipf"/>
-          <Option name="freebsd_path_ipnat"/>
-          <Option name="freebsd_path_sysctl"/>
+          <Option name="freebsd_path_ipf"></Option>
+          <Option name="freebsd_path_ipnat"></Option>
+          <Option name="freebsd_path_sysctl"></Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="in_out_code">True</Option>
           <Option name="ipf_log_body">False</Option>
-          <Option name="ipf_log_facility"/>
-          <Option name="ipf_log_level"/>
+          <Option name="ipf_log_facility"></Option>
+          <Option name="ipf_log_level"></Option>
           <Option name="ipf_log_or_block">False</Option>
           <Option name="ipf_nat_ftp_proxy">False</Option>
           <Option name="ipf_nat_raudio_proxy">False</Option>
@@ -5167,14 +5209,14 @@
           <Option name="ipf_return_icmp_as_dest">False</Option>
           <Option name="manage_virtual_addr">False</Option>
           <Option name="pass_all_out">False</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
         </FirewallOptions>
       </Firewall>
       <Firewall id="id3DF3D0AD" host_OS="freebsd" lastCompiled="1157929213" lastInstalled="0" lastModified="0" platform="ipf" name="firewall9" comment="" ro="False">
         <NAT id="id3DF3D0AE" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id3DF3D0AF" disabled="False" position="0" action="Translate" comment="">
+          <NATRule id="id3DF3D0AF" disabled="False" group="" position="0" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -5193,12 +5235,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3DF3D0BD" disabled="False" position="1" action="Translate" comment="">
+          <NATRule id="id3DF3D0BD" disabled="False" group="" position="1" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -5217,12 +5262,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3DF3D0CB" disabled="False" position="2" action="Translate" comment="">
+          <NATRule id="id3DF3D0CB" disabled="False" group="" position="2" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -5241,12 +5289,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3DF3D0D9" disabled="False" position="3" action="Translate" comment="">
+          <NATRule id="id3DF3D0D9" disabled="False" group="" position="3" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -5265,12 +5316,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3DF3D0E7" disabled="False" position="4" action="Translate" comment="">
+          <NATRule id="id3DF3D0E7" disabled="False" group="" position="4" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -5289,12 +5343,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3DF3D0F5" disabled="False" position="5" action="Translate" comment="">
+          <NATRule id="id3DF3D0F5" disabled="False" group="" position="5" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -5313,12 +5370,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3DF3D103" disabled="False" position="6" action="Translate" comment="">
+          <NATRule id="id3DF3D103" disabled="False" group="" position="6" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -5337,12 +5397,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3DF3D111" disabled="False" position="7" action="Translate" comment="">
+          <NATRule id="id3DF3D111" disabled="False" group="" position="7" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -5361,12 +5424,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3E65B753" disabled="False" position="8" action="Translate" comment="">
+          <NATRule id="id3E65B753" disabled="False" group="" position="8" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -5385,12 +5451,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3DF3D11F" disabled="False" position="9" action="Translate" comment="">
+          <NATRule id="id3DF3D11F" disabled="False" group="" position="9" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -5409,15 +5478,18 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
         </NAT>
         <Policy id="id3DF3D12D" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id3DF3DFB0" disabled="False" log="True" position="0" action="Deny" direction="Inbound" comment="">
+          <PolicyRule id="id3DF3DFB0" disabled="False" group="" log="True" position="0" action="Deny" direction="Inbound" comment="">
             <Src neg="True">
               <ObjectRef ref="id3B665643"/>
             </Src>
@@ -5434,13 +5506,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3DF3E09E" disabled="False" log="False" position="1" action="Accept" direction="Inbound" comment="">
+          <PolicyRule id="id3DF3E09E" disabled="False" group="" log="False" position="1" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
               <ObjectRef ref="id3B665643"/>
             </Src>
@@ -5458,11 +5528,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3DF3D16E" disabled="False" log="False" position="2" action="Accept" direction="Inbound" comment="">
+          <PolicyRule id="id3DF3D16E" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="">
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3DF3D0AD"/>
@@ -5480,11 +5549,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3E5F1BBD" disabled="False" log="False" position="3" action="Accounting" direction="Both" comment="">
+          <PolicyRule id="id3E5F1BBD" disabled="False" group="" log="False" position="3" action="Accounting" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5501,13 +5569,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3E5F1BB3" disabled="False" log="True" position="4" action="Accounting" direction="Both" comment="">
+          <PolicyRule id="id3E5F1BB3" disabled="False" group="" log="True" position="4" action="Accounting" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5524,13 +5590,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3DF3D12E" disabled="False" log="False" position="5" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3DF3D12E" disabled="False" group="" log="False" position="5" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5547,11 +5611,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3DF3D563" disabled="False" log="False" position="6" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3DF3D563" disabled="False" group="" log="False" position="6" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -5568,11 +5631,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3DF3D156" disabled="False" log="True" position="7" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3DF3D156" disabled="False" group="" log="True" position="7" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5589,11 +5651,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -5620,20 +5680,20 @@
         <FirewallOptions>
           <Option name="action_on_reject">ICMP host prohibited</Option>
           <Option name="check_shading">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="debug">False</Option>
           <Option name="eliminate_duplicates">True</Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="freebsd_ip_forward">1</Option>
-          <Option name="freebsd_path_ipf"/>
-          <Option name="freebsd_path_ipnat"/>
-          <Option name="freebsd_path_sysctl"/>
+          <Option name="freebsd_path_ipf"></Option>
+          <Option name="freebsd_path_ipnat"></Option>
+          <Option name="freebsd_path_sysctl"></Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="in_out_code">True</Option>
           <Option name="ipf_log_body">False</Option>
-          <Option name="ipf_log_facility"/>
-          <Option name="ipf_log_level"/>
+          <Option name="ipf_log_facility"></Option>
+          <Option name="ipf_log_level"></Option>
           <Option name="ipf_log_or_block">False</Option>
           <Option name="ipf_nat_ftp_proxy">False</Option>
           <Option name="ipf_nat_h323_proxy">False</Option>
@@ -5643,9 +5703,9 @@
           <Option name="ipf_return_icmp_as_dest">False</Option>
           <Option name="manage_virtual_addr">False</Option>
           <Option name="pass_all_out">False</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
         </FirewallOptions>
       </Firewall>
       <Firewall id="id3FCA516A" host_OS="freebsd" inactive="False" lastCompiled="1157929196" lastInstalled="0" lastModified="1156049389" platform="ipf" version="" name="firewall10" comment="" ro="False">
@@ -5653,7 +5713,7 @@
           <RuleSetOptions/>
         </NAT>
         <Policy id="id3FCA51F8" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id3FCA51F9" disabled="False" log="False" position="0" action="Accounting" direction="Both" comment="">
+          <PolicyRule id="id3FCA51F9" disabled="False" group="" log="False" position="0" action="Accounting" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5670,13 +5730,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3FCA520D" disabled="False" log="False" position="1" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3FCA520D" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
             <Src neg="True">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
@@ -5703,11 +5761,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3FCC3AD6" disabled="False" log="False" position="2" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3FCC3AD6" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -5725,11 +5782,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3FCA5217" disabled="False" log="False" position="3" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3FCA5217" disabled="False" group="" log="False" position="3" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
@@ -5756,13 +5812,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3FCC1E1A" disabled="False" log="False" position="4" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3FCC1E1A" disabled="False" group="" log="False" position="4" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="host-hostA"/>
             </Src>
@@ -5785,13 +5839,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3FCC1E4F" disabled="False" log="False" position="5" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3FCC1E4F" disabled="False" group="" log="False" position="5" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
@@ -5815,13 +5867,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3FCC1EC3" disabled="False" log="False" position="6" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3FCC1EC3" disabled="False" group="" log="False" position="6" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
@@ -5845,13 +5895,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3FCA5221" disabled="False" log="True" position="7" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3FCA5221" disabled="False" group="" log="True" position="7" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5868,11 +5916,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -5904,21 +5950,21 @@
           <Option name="accept_new_tcp_with_no_syn">False</Option>
           <Option name="action_on_reject">ICMP host prohibited</Option>
           <Option name="check_shading">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">False</Option>
           <Option name="debug">False</Option>
           <Option name="eliminate_duplicates">False</Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="freebsd_ip_forward">1</Option>
-          <Option name="freebsd_path_ipf"/>
-          <Option name="freebsd_path_ipnat"/>
-          <Option name="freebsd_path_sysctl"/>
+          <Option name="freebsd_path_ipf"></Option>
+          <Option name="freebsd_path_ipnat"></Option>
+          <Option name="freebsd_path_sysctl"></Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="in_out_code">False</Option>
           <Option name="ipf_log_body">False</Option>
-          <Option name="ipf_log_facility"/>
-          <Option name="ipf_log_level"/>
+          <Option name="ipf_log_facility"></Option>
+          <Option name="ipf_log_level"></Option>
           <Option name="ipf_log_or_block">False</Option>
           <Option name="ipf_nat_ftp_proxy">False</Option>
           <Option name="ipf_nat_h323_proxy">False</Option>
@@ -5929,14 +5975,14 @@
           <Option name="manage_virtual_addr">False</Option>
           <Option name="optimize">True</Option>
           <Option name="pass_all_out">True</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
         </FirewallOptions>
       </Firewall>
       <Firewall id="id3FF5DC0E" host_OS="freebsd" lastCompiled="1172425374" lastInstalled="0" lastModified="0" platform="ipf" name="firewall11" comment="" ro="False">
         <NAT id="id3FF5DC12" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id3FF5DC26" disabled="False" position="0" action="Translate" comment="">
+          <NATRule id="id3FF5DC26" disabled="False" group="" position="0" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -5955,15 +6001,18 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
         </NAT>
         <Policy id="id3FF5DC11" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id3FF5DC82" disabled="False" log="False" position="0" action="Accept" direction="Inbound" comment="">
+          <PolicyRule id="id3FF5DC82" disabled="False" group="" log="False" position="0" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5980,11 +6029,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3FF5DC56" disabled="False" log="False" position="1" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3FF5DC56" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6001,11 +6049,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3FF5DC61" disabled="False" log="False" position="2" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3FF5DC61" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6022,9 +6069,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -6057,21 +6103,21 @@
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP host prohibited</Option>
           <Option name="check_shading">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="eliminate_duplicates">True</Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="freebsd_ip_forward">1</Option>
-          <Option name="freebsd_path_ipf"/>
-          <Option name="freebsd_path_ipnat"/>
-          <Option name="freebsd_path_sysctl"/>
+          <Option name="freebsd_path_ipf"></Option>
+          <Option name="freebsd_path_ipnat"></Option>
+          <Option name="freebsd_path_sysctl"></Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="in_out_code">True</Option>
           <Option name="ipf_log_body">False</Option>
-          <Option name="ipf_log_facility"/>
-          <Option name="ipf_log_level"/>
+          <Option name="ipf_log_facility"></Option>
+          <Option name="ipf_log_level"></Option>
           <Option name="ipf_log_or_block">False</Option>
           <Option name="ipf_nat_ftp_proxy">False</Option>
           <Option name="ipf_nat_h323_proxy">False</Option>
@@ -6084,14 +6130,14 @@
           <Option name="manage_virtual_addr">True</Option>
           <Option name="optimize">False</Option>
           <Option name="pass_all_out">False</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
         </FirewallOptions>
       </Firewall>
       <Firewall id="id424A636E" host_OS="freebsd" lastCompiled="1157929209" lastInstalled="0" lastModified="0" platform="ipf" version="" name="firewall5" comment="Dynamic interface ppp0" ro="False">
         <NAT id="id424A63A6" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id424A63A7" disabled="False" position="0" action="Translate" comment="">
+          <NATRule id="id424A63A7" disabled="False" group="" position="0" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -6110,12 +6156,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id424A63B5" disabled="False" position="1" action="Translate" comment="">
+          <NATRule id="id424A63B5" disabled="False" group="" position="1" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -6134,12 +6183,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id424A63C3" disabled="False" position="2" action="Translate" comment="">
+          <NATRule id="id424A63C3" disabled="False" group="" position="2" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -6158,12 +6210,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id424A63D1" disabled="False" position="3" action="Translate" comment="">
+          <NATRule id="id424A63D1" disabled="False" group="" position="3" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -6182,12 +6237,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id424A63DF" disabled="False" position="4" action="Translate" comment="">
+          <NATRule id="id424A63DF" disabled="False" group="" position="4" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -6206,12 +6264,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id424A63ED" disabled="False" position="5" action="Translate" comment="">
+          <NATRule id="id424A63ED" disabled="False" group="" position="5" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -6230,12 +6291,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id424A63FB" disabled="False" position="6" action="Translate" comment="">
+          <NATRule id="id424A63FB" disabled="False" group="" position="6" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -6254,12 +6318,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id424A6409" disabled="False" position="7" action="Translate" comment="">
+          <NATRule id="id424A6409" disabled="False" group="" position="7" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -6278,12 +6345,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id424A6417" disabled="False" position="8" action="Translate" comment="">
+          <NATRule id="id424A6417" disabled="False" group="" position="8" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -6302,15 +6372,18 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
         </NAT>
         <Policy id="id424A6373" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id424A6374" disabled="False" log="False" position="0" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id424A6374" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6327,11 +6400,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id424A96DA" disabled="False" log="False" position="1" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id424A96DA" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6348,11 +6420,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id424A637E" disabled="False" log="False" position="2" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id424A637E" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6369,11 +6440,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id424A6388" disabled="False" log="False" position="3" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id424A6388" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6390,11 +6460,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id424A6392" disabled="False" log="False" position="4" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id424A6392" disabled="False" group="" log="False" position="4" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6411,11 +6480,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id424A639C" disabled="False" log="True" position="5" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id424A639C" disabled="False" group="" log="True" position="5" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6432,11 +6500,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -6467,27 +6533,27 @@
         <FirewallOptions>
           <Option name="accept_new_tcp_with_no_syn">False</Option>
           <Option name="action_on_reject">ICMP host prohibited</Option>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">False</Option>
           <Option name="debug">False</Option>
           <Option name="dynAddr">True</Option>
           <Option name="eliminate_duplicates">True</Option>
-          <Option name="epilog_script"/>
+          <Option name="epilog_script"></Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="freebsd_ip_forward">1</Option>
-          <Option name="freebsd_path_ipf"/>
-          <Option name="freebsd_path_ipnat"/>
-          <Option name="freebsd_path_sysctl"/>
+          <Option name="freebsd_path_ipf"></Option>
+          <Option name="freebsd_path_ipnat"></Option>
+          <Option name="freebsd_path_sysctl"></Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="in_out_code">True</Option>
           <Option name="ipf_log_body">False</Option>
-          <Option name="ipf_log_facility"/>
-          <Option name="ipf_log_level"/>
+          <Option name="ipf_log_facility"></Option>
+          <Option name="ipf_log_level"></Option>
           <Option name="ipf_log_or_block">False</Option>
           <Option name="ipf_nat_ftp_proxy">False</Option>
           <Option name="ipf_nat_h323_proxy">False</Option>
@@ -6496,20 +6562,20 @@
           <Option name="ipf_nat_rcmd_proxy">False</Option>
           <Option name="ipf_return_icmp_as_dest">False</Option>
           <Option name="manage_virtual_addr">False</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="optimize">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">False</Option>
-          <Option name="prolog_script"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="prolog_script"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
         </FirewallOptions>
       </Firewall>
       <Firewall id="id43867C1018346" host_OS="freebsd" lastCompiled="1157929202" lastInstalled="0" lastModified="0" platform="ipf" version="" name="firewall33" comment="testing DNSName object" ro="False">
         <NAT id="id43867C4818346" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id43876E2618346" disabled="False" position="0" action="Translate" comment="">
+          <NATRule id="id43876E2618346" disabled="False" group="" position="0" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -6528,12 +6594,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id43876E5218346" disabled="False" position="1" action="Translate" comment="">
+          <NATRule id="id43876E5218346" disabled="False" group="" position="1" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -6552,12 +6621,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id43876E6918346" disabled="False" position="2" action="Translate" comment="">
+          <NATRule id="id43876E6918346" disabled="False" group="" position="2" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -6577,12 +6649,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id43876E7B18346" disabled="True" position="3" action="Translate" comment="">
+          <NATRule id="id43876E7B18346" disabled="True" group="" position="3" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -6602,15 +6677,18 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
         </NAT>
         <Policy id="id43867C1618346" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id43867C2418346" disabled="False" log="False" position="0" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id43867C2418346" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id43869E8C18346"/>
             </Src>
@@ -6627,11 +6705,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id43869E9018346" disabled="False" log="False" position="1" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id43869E9018346" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id43869E8D18346"/>
             </Src>
@@ -6648,11 +6725,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id43869E9E18346" disabled="False" log="False" position="2" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id43869E9E18346" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id43869E8E18346"/>
             </Src>
@@ -6669,11 +6745,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id43869EAA18346" disabled="False" log="False" position="3" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id43869EAA18346" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id43869E8F18346"/>
             </Src>
@@ -6690,11 +6765,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4386E38318346" disabled="False" log="False" position="4" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id4386E38318346" disabled="False" group="" log="False" position="4" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6711,13 +6785,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4386E37718346" disabled="False" log="False" position="5" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id4386E37718346" disabled="False" group="" log="False" position="5" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6734,13 +6806,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id43867C3018346" disabled="False" log="False" position="6" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id43867C3018346" disabled="False" group="" log="False" position="6" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6757,11 +6827,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4386C10D18346" disabled="False" log="False" position="7" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4386C10D18346" disabled="False" group="" log="False" position="7" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6778,11 +6847,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id438728A918346" disabled="False" log="False" position="8" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id438728A918346" disabled="False" group="" log="False" position="8" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6800,11 +6868,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id438728BA18346" disabled="False" log="False" position="9" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id438728BA18346" disabled="False" group="" log="False" position="9" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6822,11 +6889,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id438728CD18346" disabled="False" log="False" position="10" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id438728CD18346" disabled="False" group="" log="False" position="10" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6844,11 +6910,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id43867C3C18346" disabled="False" log="True" position="11" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id43867C3C18346" disabled="False" group="" log="True" position="11" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6865,11 +6930,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -6896,50 +6959,50 @@
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="epilog_script"/>
-          <Option name="firewall_dir"/>
+          <Option name="epilog_script"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">False</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -6953,20 +7016,20 @@
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="platform">iptables</Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"/>
+          <Option name="prolog_script"></Option>
           <Option name="proxy_arp">False</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
-          <Option name="sshArgs"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -6979,7 +7042,7 @@
       </Firewall>
       <Firewall id="id4389EDAE18346" host_OS="freebsd" lastCompiled="1157929203" lastInstalled="0" lastModified="0" platform="ipf" version="" name="firewall34" comment="testing AddressTable object" ro="False">
         <NAT id="id4389EE4818346" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id4389EEB018346" disabled="True" position="0" action="Translate" comment="">
+          <NATRule id="id4389EEB018346" disabled="True" group="" position="0" action="Translate" comment="">
             <OSrc neg="True">
               <ObjectRef ref="id4389EE9118346"/>
             </OSrc>
@@ -6998,12 +7061,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id43891B6E674" disabled="True" position="1" action="Translate" comment="">
+          <NATRule id="id43891B6E674" disabled="True" group="" position="1" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="id43913DEA25682"/>
             </OSrc>
@@ -7022,15 +7088,18 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
         </NAT>
         <Policy id="id4389EDB418346" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id4389EDB518346" disabled="False" log="False" position="0" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4389EDB518346" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -7047,11 +7116,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4388CFEA674" disabled="True" log="True" position="1" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id4388CFEA674" disabled="True" group="" log="True" position="1" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -7068,13 +7136,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4390C25825682" disabled="True" log="True" position="2" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id4390C25825682" disabled="True" group="" log="True" position="2" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -7091,13 +7157,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4389EDC118346" disabled="True" log="False" position="3" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id4389EDC118346" disabled="True" group="" log="False" position="3" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -7115,13 +7179,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4388CFF8674" disabled="True" log="True" position="4" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id4388CFF8674" disabled="True" group="" log="True" position="4" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4389EE9118346"/>
             </Src>
@@ -7138,13 +7200,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4388C36F674" disabled="True" log="True" position="5" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id4388C36F674" disabled="True" group="" log="True" position="5" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4389EE9118346"/>
               <ObjectRef ref="id4388C37D674"/>
@@ -7162,13 +7222,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4388F5A9674" disabled="True" log="False" position="6" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4388F5A9674" disabled="True" group="" log="False" position="6" action="Accept" direction="Both" comment="">
             <Src neg="True">
               <ObjectRef ref="id4389EE9118346"/>
               <ObjectRef ref="id4388C37D674"/>
@@ -7186,11 +7244,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4389EEA118346" disabled="False" log="False" position="7" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4389EEA118346" disabled="False" group="" log="False" position="7" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -7207,11 +7264,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4389EDCD18346" disabled="False" log="False" position="8" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4389EDCD18346" disabled="False" group="" log="False" position="8" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id43913DEA25682"/>
             </Src>
@@ -7228,11 +7284,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4389EE3C18346" disabled="False" log="True" position="9" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id4389EE3C18346" disabled="False" group="" log="True" position="9" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -7249,11 +7304,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -7280,50 +7333,50 @@
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="epilog_script"/>
-          <Option name="firewall_dir"/>
+          <Option name="epilog_script"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">False</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -7337,20 +7390,20 @@
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="platform">iptables</Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"/>
+          <Option name="prolog_script"></Option>
           <Option name="proxy_arp">False</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
-          <Option name="sshArgs"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -7363,7 +7416,7 @@
       </Firewall>
       <Firewall id="id43F7C93131168" host_OS="freebsd" lastCompiled="1157929205" lastInstalled="0" lastModified="0" platform="ipf" version="" name="firewall35" comment="Testing action Custom" ro="False">
         <NAT id="id43F7C99A31168" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id43F7C99B31168" disabled="False" position="0" action="Translate" comment="">
+          <NATRule id="id43F7C99B31168" disabled="False" group="" position="0" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -7382,12 +7435,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id43F7C9A931168" disabled="False" position="1" action="Translate" comment="">
+          <NATRule id="id43F7C9A931168" disabled="False" group="" position="1" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -7406,12 +7462,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id43F7C9B731168" disabled="False" position="2" action="Translate" comment="">
+          <NATRule id="id43F7C9B731168" disabled="False" group="" position="2" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -7430,12 +7489,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id43F7C9C531168" disabled="False" position="3" action="Translate" comment="">
+          <NATRule id="id43F7C9C531168" disabled="False" group="" position="3" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -7454,12 +7516,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id43F7C9D331168" disabled="False" position="4" action="Translate" comment="">
+          <NATRule id="id43F7C9D331168" disabled="False" group="" position="4" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -7478,12 +7543,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id43F7C9E131168" disabled="False" position="5" action="Translate" comment="">
+          <NATRule id="id43F7C9E131168" disabled="False" group="" position="5" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -7502,12 +7570,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id43F7C9EF31168" disabled="False" position="6" action="Translate" comment="">
+          <NATRule id="id43F7C9EF31168" disabled="False" group="" position="6" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -7526,12 +7597,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id43F7C9FD31168" disabled="False" position="7" action="Translate" comment="">
+          <NATRule id="id43F7C9FD31168" disabled="False" group="" position="7" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -7550,12 +7624,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id43F7CA0B31168" disabled="False" position="8" action="Translate" comment="">
+          <NATRule id="id43F7CA0B31168" disabled="False" group="" position="8" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -7574,12 +7651,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id43F7CA1931168" disabled="False" position="9" action="Translate" comment="">
+          <NATRule id="id43F7CA1931168" disabled="False" group="" position="9" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -7598,15 +7678,18 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
         </NAT>
         <Policy id="id43F7C93731168" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id43F7C93831168" disabled="False" log="False" position="0" action="Custom" direction="Inbound" comment="">
+          <PolicyRule id="id43F7C93831168" disabled="False" group="" log="False" position="0" action="Custom" direction="Inbound" comment="">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -7623,21 +7706,19 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="classify_str"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="classify_str"></Option>
               <Option name="custom_str">auth</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="pf_classify_str"></Option>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
-              <Option name="tagvalue"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="tagvalue"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id43F7D90631168" disabled="False" log="False" position="1" action="Custom" direction="Inbound" comment="">
+          <PolicyRule id="id43F7D90631168" disabled="False" group="" log="False" position="1" action="Custom" direction="Inbound" comment="">
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -7654,21 +7735,19 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="classify_str"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="classify_str"></Option>
               <Option name="custom_str">auth</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="pf_classify_str"></Option>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
-              <Option name="tagvalue"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="tagvalue"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id43F7D91731168" disabled="False" log="False" position="2" action="Accept" direction="Inbound" comment="">
+          <PolicyRule id="id43F7D91731168" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -7685,11 +7764,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id43F7C98E31168" disabled="False" log="True" position="3" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id43F7C98E31168" disabled="False" group="" log="True" position="3" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -7706,11 +7784,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -7737,20 +7813,20 @@
         <FirewallOptions>
           <Option name="action_on_reject">ICMP host prohibited</Option>
           <Option name="check_shading">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="debug">False</Option>
           <Option name="eliminate_duplicates">True</Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="freebsd_ip_forward">1</Option>
-          <Option name="freebsd_path_ipf"/>
-          <Option name="freebsd_path_ipnat"/>
-          <Option name="freebsd_path_sysctl"/>
+          <Option name="freebsd_path_ipf"></Option>
+          <Option name="freebsd_path_ipnat"></Option>
+          <Option name="freebsd_path_sysctl"></Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="in_out_code">True</Option>
           <Option name="ipf_log_body">False</Option>
-          <Option name="ipf_log_facility"/>
-          <Option name="ipf_log_level"/>
+          <Option name="ipf_log_facility"></Option>
+          <Option name="ipf_log_level"></Option>
           <Option name="ipf_log_or_block">False</Option>
           <Option name="ipf_nat_ftp_proxy">False</Option>
           <Option name="ipf_nat_h323_proxy">False</Option>
@@ -7760,9 +7836,9 @@
           <Option name="ipf_return_icmp_as_dest">False</Option>
           <Option name="manage_virtual_addr">False</Option>
           <Option name="pass_all_out">False</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
         </FirewallOptions>
       </Firewall>
     </ObjectGroup>
diff --git a/test/ipfw/objects-for-regression-tests.fwb b/test/ipfw/objects-for-regression-tests.fwb
index 6ebcbd3f7..ea6409132 100644
--- a/test/ipfw/objects-for-regression-tests.fwb
+++ b/test/ipfw/objects-for-regression-tests.fwb
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
-<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="20" lastModified="1257365069" id="root">
+<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="21" lastModified="1257365069" id="root">
   <Library id="sysid99" name="Deleted Objects" comment="" ro="False">
     <ICMP6Service id="idE0C27650" code="0" type="1" name="ipv6 dest unreachable" comment="No route to destination" ro="False"/>
     <Library id="id40E233F3" color="#FFFFFF" name="West Coast" comment="" ro="False">
@@ -138,9 +138,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -156,9 +156,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
@@ -173,9 +173,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -191,9 +191,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -248,9 +248,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr_filter">True</Option>
           </HostOptions>
         </Host>
@@ -325,9 +325,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -343,9 +343,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -361,9 +361,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">False</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -379,9 +379,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">False</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -397,9 +397,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">False</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -415,9 +415,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">False</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -433,9 +433,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">False</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -489,9 +489,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
@@ -601,26 +601,26 @@
       </ServiceGroup>
       <ServiceGroup id="stdid13_1" name="Custom_Services" comment="" ro="False">
         <CustomService id="id3B64FE22" name="talk" comment="Talk support" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"/>
-          <CustomServiceCommand platform="fwsm"/>
-          <CustomServiceCommand platform="iosacl"/>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfilter"/>
-          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="fwsm"></CustomServiceCommand>
+          <CustomServiceCommand platform="iosacl"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m ip_conntrack_talk -m ip_nat_talk</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
         <CustomService id="id3F162C44" name="establ" comment="" ro="False" protocol="tcp" address_family="ipv4">
-          <CustomServiceCommand platform="fwsm"/>
-          <CustomServiceCommand platform="iosacl"/>
-          <CustomServiceCommand platform="ipf"/>
+          <CustomServiceCommand platform="fwsm"></CustomServiceCommand>
+          <CustomServiceCommand platform="iosacl"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
           <CustomServiceCommand platform="ipfw">established</CustomServiceCommand>
-          <CustomServiceCommand platform="iptables"/>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="iptables"></CustomServiceCommand>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
       </ServiceGroup>
       <ServiceGroup id="stdid05_1_userservices" name="Users" comment="" ro="False"/>
@@ -628,7 +628,7 @@
     <ObjectGroup id="stdid12_1" name="Firewalls" comment="" ro="False">
       <Firewall id="fw-firewall2" host_OS="freebsd" lastCompiled="1249844841" lastInstalled="0" lastModified="1263586941" platform="ipfw" version="" name="firewall" comment="this is simple firewall with two interfaces. Test regular policy rules, including IP_fragments rule" ro="False">
         <NAT id="nat-firewall2" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="nat-firewall2-0" disabled="False" position="0" action="Translate" comment="">
+          <NATRule id="nat-firewall2-0" disabled="False" group="" position="0" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -647,12 +647,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="nat-firewall2-1" disabled="False" position="1" action="Translate" comment="">
+          <NATRule id="nat-firewall2-1" disabled="False" group="" position="1" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -671,12 +674,15 @@
             <TSrv neg="False">
               <ServiceRef ref="tcp-SMTP"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3CDB43B8" disabled="False" position="2" action="Translate" comment="">
+          <NATRule id="id3CDB43B8" disabled="False" group="" position="2" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -695,12 +701,15 @@
             <TSrv neg="False">
               <ServiceRef ref="id3B4FF09A"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D7581A7" disabled="False" position="3" action="Translate" comment="">
+          <NATRule id="id3D7581A7" disabled="False" group="" position="3" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -720,12 +729,15 @@
             <TSrv neg="False">
               <ServiceRef ref="id3B4FF09A"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D75843D" disabled="False" position="4" action="Translate" comment="">
+          <NATRule id="id3D75843D" disabled="False" group="" position="4" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -745,15 +757,18 @@
             <TSrv neg="False">
               <ServiceRef ref="id3B4FF09A"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
         </NAT>
         <Policy id="pol-firewall2" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id3B09D29D" disabled="False" log="True" position="0" action="Deny" direction="Inbound" comment="">
+          <PolicyRule id="id3B09D29D" disabled="False" group="" log="True" position="0" action="Deny" direction="Inbound" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -766,15 +781,12 @@
             <Itf neg="False">
               <ObjectRef ref="if-FW-firewall2-eth1"/>
             </Itf>
-            
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="pol-firewall2-0" disabled="False" log="True" position="1" action="Deny" direction="Inbound" comment="Automatically generated rule blocking short fragments">
+          <PolicyRule id="pol-firewall2-0" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Automatically generated rule blocking short fragments">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -791,13 +803,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="pol-firewall2-1" disabled="False" log="True" position="2" action="Deny" direction="Inbound" comment="Automatically generated anti-spoofing rule">
+          <PolicyRule id="pol-firewall2-1" disabled="False" group="" log="True" position="2" action="Deny" direction="Inbound" comment="Automatically generated anti-spoofing rule">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="fw-firewall2"/>
@@ -815,13 +825,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B92DFC5" disabled="False" log="False" position="3" action="Accept" direction="Both" comment="комментарий по-русски">
+          <PolicyRule id="id3B92DFC5" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="комментарий по-русски">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -834,13 +842,11 @@
             <Itf neg="False">
               <ObjectRef ref="if-FW-firewall2-eth0"/>
             </Itf>
-            
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3C4E4C38" disabled="False" log="True" position="4" action="Deny" direction="Inbound" comment="">
+          <PolicyRule id="id3C4E4C38" disabled="False" group="" log="True" position="4" action="Deny" direction="Inbound" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -853,15 +859,12 @@
             <Itf neg="False">
               <ObjectRef ref="if-FW-firewall2-eth0"/>
             </Itf>
-            
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B58E39D" disabled="False" log="True" position="5" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3B58E39D" disabled="False" group="" log="True" position="5" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -879,15 +882,13 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"/>
-              <Option name="log_prefix"/>
+              <Option name="log_limit_suffix"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id8706X26107" disabled="False" group="" log="True" position="6" action="Reject" direction="Both" comment="">
             <Src neg="False">
@@ -906,14 +907,12 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="ipf_keep_frags">False</Option>
               <Option name="ipf_return_icmp_as_dest">True</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id8686X26107" disabled="False" group="" log="True" position="7" action="Reject" direction="Both" comment="">
             <Src neg="False">
@@ -932,16 +931,14 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="ipf_keep_frags">False</Option>
               <Option name="ipf_return_icmp_as_dest">True</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B6659FC" disabled="False" log="True" position="8" action="Reject" direction="Both" comment="">
+          <PolicyRule id="id3B6659FC" disabled="False" group="" log="True" position="8" action="Reject" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -961,16 +958,14 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="ipf_keep_frags">False</Option>
               <Option name="ipf_return_icmp_as_dest">True</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3CE74D81" disabled="False" log="False" position="9" action="Reject" direction="Both" comment="">
+          <PolicyRule id="id3CE74D81" disabled="False" group="" log="False" position="9" action="Reject" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -987,13 +982,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3BF1B45E" disabled="True" log="False" position="10" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3BF1B45E" disabled="True" group="" log="False" position="10" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id3BF1B3E1"/>
             </Src>
@@ -1010,16 +1003,14 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3BF1B44E" disabled="True" log="False" position="11" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3BF1B44E" disabled="True" group="" log="False" position="11" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id3BF1B3E7"/>
             </Src>
@@ -1036,16 +1027,14 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="pol-firewall2-3" disabled="False" log="False" position="12" action="Accept" direction="Both" comment="">
+          <PolicyRule id="pol-firewall2-3" disabled="False" group="" log="False" position="12" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="host-secondary1-com"/>
               <ObjectRef ref="host-secondary2-com"/>
@@ -1065,16 +1054,14 @@
               <IntervalRef ref="id3C63479E"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="pol-firewall2-2" disabled="False" log="False" position="13" action="Accept" direction="Both" comment="">
+          <PolicyRule id="pol-firewall2-2" disabled="False" group="" log="False" position="13" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1091,16 +1078,14 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3D98E652" disabled="False" log="False" position="14" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3D98E652" disabled="False" group="" log="False" position="14" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1118,16 +1103,14 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3CD8770E" disabled="False" log="False" position="15" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3CD8770E" disabled="False" group="" log="False" position="15" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1145,16 +1128,14 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3CD87B1E" disabled="False" log="False" position="16" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3CD87B1E" disabled="False" group="" log="False" position="16" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1172,16 +1153,14 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="pol-firewall2-4" disabled="False" log="False" position="17" action="Accept" direction="Both" comment="">
+          <PolicyRule id="pol-firewall2-4" disabled="False" group="" log="False" position="17" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1199,16 +1178,14 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id41D514D2" disabled="False" log="False" position="18" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id41D514D2" disabled="False" group="" log="False" position="18" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1229,16 +1206,14 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B58E180" disabled="False" log="True" position="19" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3B58E180" disabled="False" group="" log="True" position="19" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="fw-firewall2"/>
             </Src>
@@ -1255,11 +1230,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="pol-firewall2-5" disabled="False" log="False" position="20" action="Accept" direction="Both" comment="Automatically generated 'masquerading' rule">
+          <PolicyRule id="pol-firewall2-5" disabled="False" group="" log="False" position="20" action="Accept" direction="Both" comment="Automatically generated 'masquerading' rule">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="fw-firewall2"/>
@@ -1277,16 +1251,14 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="pol-firewall2-7" disabled="False" log="True" position="21" action="Deny" direction="Both" comment="Automatically generated 'catch all' rule">
+          <PolicyRule id="pol-firewall2-7" disabled="False" group="" log="True" position="21" action="Deny" direction="Both" comment="Automatically generated 'catch all' rule">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1303,16 +1275,14 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"/>
-              <Option name="log_prefix"/>
+              <Option name="log_limit_suffix"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -1336,37 +1306,37 @@
           <Option name="accept_established">False</Option>
           <Option name="accept_new_tcp_with_no_syn">False</Option>
           <Option name="action_on_reject">ICMP port unreachable</Option>
-          <Option name="activationCmd"/>
+          <Option name="activationCmd"></Option>
           <Option name="add_check_state_rule">True</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="cmdline">-v</Option>
-          <Option name="compiler"/>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">False</Option>
           <Option name="debug">True</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="eliminate_duplicates">True</Option>
-          <Option name="epilog_script"/>
-          <Option name="firewall_dir"/>
+          <Option name="epilog_script"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
-          <Option name="freebsd_ip_forward"/>
-          <Option name="freebsd_ip_redirect"/>
-          <Option name="freebsd_ip_sourceroute"/>
-          <Option name="freebsd_path_ipf"/>
+          <Option name="freebsd_ip_forward"></Option>
+          <Option name="freebsd_ip_redirect"></Option>
+          <Option name="freebsd_ip_sourceroute"></Option>
+          <Option name="freebsd_path_ipf"></Option>
           <Option name="freebsd_path_ipfw">/usr/sbin/ipfw</Option>
-          <Option name="freebsd_path_ipnat"/>
-          <Option name="freebsd_path_sysctl"/>
+          <Option name="freebsd_path_ipnat"></Option>
+          <Option name="freebsd_path_sysctl"></Option>
           <Option name="ignore_empty_groups">True</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="ipf_log_body">False</Option>
-          <Option name="ipf_log_facility"/>
-          <Option name="ipf_log_level"/>
+          <Option name="ipf_log_facility"></Option>
+          <Option name="ipf_log_level"></Option>
           <Option name="ipf_log_or_block">False</Option>
           <Option name="ipf_nat_ftp_proxy">False</Option>
           <Option name="ipf_nat_h323_proxy">False</Option>
@@ -1386,7 +1356,7 @@
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
@@ -1399,23 +1369,23 @@
           <Option name="openbsd_ip_forward">1</Option>
           <Option name="openbsd_ip_redirect">0</Option>
           <Option name="openbsd_ip_sourceroute">0</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">False</Option>
           <Option name="platform">iptables</Option>
-          <Option name="prolog_script"/>
-          <Option name="scpArgs"/>
-          <Option name="script_env_path"/>
+          <Option name="prolog_script"></Option>
+          <Option name="scpArgs"></Option>
+          <Option name="script_env_path"></Option>
           <Option name="script_name_on_firewall">ipfw.fw</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
-          <Option name="sshArgs"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
+          <Option name="sshArgs"></Option>
           <Option name="use_numeric_log_levels">False</Option>
         </FirewallOptions>
       </Firewall>
       <Firewall id="id3AF5AA0A" host_OS="freebsd" lastCompiled="1249844783" lastInstalled="0" lastModified="0" platform="ipfw" name="firewall1" comment="this object is used to test all kinds of negation in policy rules&#10;&#10;Currently negation in NAT is not supported for ipf, therefore all rules in NAT with&#10;negation are disabled&#10;" ro="False">
         <NAT id="id3AF5AA0D" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id3C98491C" disabled="True" position="0" action="Translate" comment="">
+          <NATRule id="id3C98491C" disabled="True" group="" position="0" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -1434,12 +1404,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3AFADC09" disabled="False" position="1" action="Translate" comment="">
+          <NATRule id="id3AFADC09" disabled="False" group="" position="1" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="host-hostA"/>
             </OSrc>
@@ -1458,12 +1431,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3CD23959" disabled="True" position="2" action="Translate" comment="">
+          <NATRule id="id3CD23959" disabled="True" group="" position="2" action="Translate" comment="">
             <OSrc neg="True">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -1482,12 +1458,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3B1328FB" disabled="False" position="3" action="Translate" comment="">
+          <NATRule id="id3B1328FB" disabled="False" group="" position="3" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -1506,12 +1485,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3AF5AAD3" disabled="True" position="4" action="Translate" comment="">
+          <NATRule id="id3AF5AAD3" disabled="True" group="" position="4" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -1530,12 +1512,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3CCA1B57" disabled="True" position="5" action="Translate" comment="">
+          <NATRule id="id3CCA1B57" disabled="True" group="" position="5" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -1554,12 +1539,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3B50F7CB" disabled="True" position="6" action="Translate" comment="">
+          <NATRule id="id3B50F7CB" disabled="True" group="" position="6" action="Translate" comment="">
             <OSrc neg="True">
               <ObjectRef ref="id3B022266"/>
             </OSrc>
@@ -1578,12 +1566,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3BD8D94B" disabled="True" position="7" action="Translate" comment="">
+          <NATRule id="id3BD8D94B" disabled="True" group="" position="7" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -1602,12 +1593,15 @@
             <TSrv neg="False">
               <ServiceRef ref="id3B5009F7"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3BD8D9DD" disabled="True" position="8" action="Translate" comment="">
+          <NATRule id="id3BD8D9DD" disabled="True" group="" position="8" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -1626,12 +1620,15 @@
             <TSrv neg="False">
               <ServiceRef ref="id3B5009F7"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3BBC0EA4" disabled="True" position="9" action="Translate" comment="">
+          <NATRule id="id3BBC0EA4" disabled="True" group="" position="9" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="id3B4572AF"/>
             </OSrc>
@@ -1650,12 +1647,15 @@
             <TSrv neg="False">
               <ServiceRef ref="id3B5009F7"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3BBC0F93" disabled="True" position="10" action="Translate" comment="">
+          <NATRule id="id3BBC0F93" disabled="True" group="" position="10" action="Translate" comment="">
             <OSrc neg="True">
               <ObjectRef ref="id3B4572AF"/>
             </OSrc>
@@ -1674,12 +1674,15 @@
             <TSrv neg="False">
               <ServiceRef ref="id3B5009F7"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3BC6BCE5" disabled="True" position="11" action="Translate" comment="">
+          <NATRule id="id3BC6BCE5" disabled="True" group="" position="11" action="Translate" comment="">
             <OSrc neg="True">
               <ObjectRef ref="host-hostA"/>
             </OSrc>
@@ -1698,15 +1701,18 @@
             <TSrv neg="False">
               <ServiceRef ref="id3B5009F7"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
         </NAT>
         <Policy id="id3AF5AA0C" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id3C5987DC" disabled="False" log="True" position="0" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3C5987DC" disabled="False" group="" log="True" position="0" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id3B4572B5"/>
             </Src>
@@ -1719,15 +1725,12 @@
             <Itf neg="False">
               <ObjectRef ref="id3AF5AA96"/>
             </Itf>
-            
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3CD34BEF" disabled="False" log="False" position="1" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3CD34BEF" disabled="False" group="" log="False" position="1" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id3B4572AF"/>
             </Src>
@@ -1744,13 +1747,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AF5AAB4" disabled="False" log="True" position="2" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
+          <PolicyRule id="id3AF5AAB4" disabled="False" group="" log="True" position="2" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3AF5AA0A"/>
@@ -1764,15 +1765,12 @@
             <Itf neg="False">
               <ObjectRef ref="id3AF5AA99"/>
             </Itf>
-            
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AF5AAAB" disabled="False" log="True" position="3" action="Deny" direction="Outbound" comment="Anti-spoofing rule">
+          <PolicyRule id="id3AF5AAAB" disabled="False" group="" log="True" position="3" action="Deny" direction="Outbound" comment="Anti-spoofing rule">
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -1785,15 +1783,12 @@
             <Itf neg="False">
               <ObjectRef ref="id3AF5AA99"/>
             </Itf>
-            
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3CDDF2FA" disabled="False" log="False" position="4" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3CDDF2FA" disabled="False" group="" log="False" position="4" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1810,11 +1805,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3CCA26E4" disabled="False" log="True" position="5" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3CCA26E4" disabled="False" group="" log="True" position="5" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1831,13 +1825,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B9AB902" disabled="True" log="True" position="6" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3B9AB902" disabled="True" group="" log="True" position="6" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1854,13 +1846,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AFC0F90" disabled="False" log="True" position="7" action="Accept" direction="Both" comment="hostF has the same IP address as firewal.">
+          <PolicyRule id="id3AFC0F90" disabled="False" group="" log="True" position="7" action="Accept" direction="Both" comment="hostF has the same IP address as firewal.">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1877,11 +1867,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B021E10" disabled="False" log="True" position="8" action="Deny" direction="Both" comment="testing negation in the policy rule">
+          <PolicyRule id="id3B021E10" disabled="False" group="" log="True" position="8" action="Deny" direction="Both" comment="testing negation in the policy rule">
             <Src neg="True">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
@@ -1899,17 +1888,15 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="limit_suffix">/minute</Option>
               <Option name="limit_value">10</Option>
-              <Option name="log_prefix"/>
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B0B4A13" disabled="False" log="True" position="9" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3B0B4A13" disabled="False" group="" log="True" position="9" action="Deny" direction="Both" comment="">
             <Src neg="True">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
@@ -1927,13 +1914,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B5535B7" disabled="False" log="True" position="10" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3B5535B7" disabled="False" group="" log="True" position="10" action="Deny" direction="Both" comment="">
             <Src neg="True">
               <ObjectRef ref="id3B022266"/>
               <ObjectRef ref="id3AF5AA0A"/>
@@ -1951,13 +1936,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3FB82A69" disabled="False" log="False" position="11" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3FB82A69" disabled="False" group="" log="False" position="11" action="Accept" direction="Both" comment="">
             <Src neg="True">
               <ObjectRef ref="id3B665641"/>
               <ObjectRef ref="id3B665643"/>
@@ -1975,11 +1958,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B11F63D" disabled="False" log="True" position="12" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3B11F63D" disabled="False" group="" log="True" position="12" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
@@ -1998,13 +1980,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3CDDF0AA" disabled="False" log="False" position="13" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3CDDF0AA" disabled="False" group="" log="False" position="13" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -2021,13 +2001,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B021E6F" disabled="True" log="True" position="14" action="Deny" direction="Both" comment="testing negation in service field">
+          <PolicyRule id="id3B021E6F" disabled="True" group="" log="True" position="14" action="Deny" direction="Both" comment="testing negation in service field">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -2046,13 +2024,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3CCA2CF4" disabled="True" log="True" position="15" action="Accept" direction="Both" comment="testing negation in service field">
+          <PolicyRule id="id3CCA2CF4" disabled="True" group="" log="True" position="15" action="Accept" direction="Both" comment="testing negation in service field">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -2071,11 +2047,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B45739A" disabled="False" log="True" position="16" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3B45739A" disabled="False" group="" log="True" position="16" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id3B4572B5"/>
             </Src>
@@ -2092,13 +2067,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AF5AAC8" disabled="False" log="False" position="17" action="Accept" direction="Both" comment="'masquerading' rule">
+          <PolicyRule id="id3AF5AAC8" disabled="False" group="" log="False" position="17" action="Accept" direction="Both" comment="'masquerading' rule">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -2115,11 +2088,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AF5AAE3" disabled="False" log="True" position="18" action="Deny" direction="Both" comment="'catch all' rule">
+          <PolicyRule id="id3AF5AAE3" disabled="False" group="" log="True" position="18" action="Deny" direction="Both" comment="'catch all' rule">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -2136,11 +2108,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -2178,29 +2148,29 @@
           <Option name="action_on_reject">ICMP net unreachable</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="eliminate_duplicates">True</Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
-          <Option name="freebsd_ip_forward"/>
-          <Option name="freebsd_ip_redirect"/>
-          <Option name="freebsd_ip_sourceroute"/>
-          <Option name="freebsd_path_ipf"/>
+          <Option name="freebsd_ip_forward"></Option>
+          <Option name="freebsd_ip_redirect"></Option>
+          <Option name="freebsd_ip_sourceroute"></Option>
+          <Option name="freebsd_path_ipf"></Option>
           <Option name="freebsd_path_ipfw">/Library/Application Support/PeerGuardian/ipfwFast</Option>
-          <Option name="freebsd_path_ipnat"/>
-          <Option name="freebsd_path_sysctl"/>
+          <Option name="freebsd_path_ipnat"></Option>
+          <Option name="freebsd_path_sysctl"></Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="ipf_log_body">False</Option>
-          <Option name="ipf_log_facility"/>
-          <Option name="ipf_log_level"/>
+          <Option name="ipf_log_facility"></Option>
+          <Option name="ipf_log_level"></Option>
           <Option name="ipf_log_or_block">False</Option>
           <Option name="ipf_nat_ftp_proxy">False</Option>
           <Option name="ipf_nat_raudio_proxy">False</Option>
@@ -2217,7 +2187,7 @@
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
@@ -2227,17 +2197,17 @@
           <Option name="pass_all_out">False</Option>
           <Option name="platform">iptables</Option>
           <Option name="proxy_arp">False</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="use_ip_tool">False</Option>
           <Option name="use_numeric_log_levels">False</Option>
         </FirewallOptions>
       </Firewall>
       <Firewall id="id3AFB66C6" host_OS="freebsd" lastCompiled="0" lastInstalled="0" lastModified="1178589993" platform="ipfw" name="firewall2" comment="this object has several interfaces and shows different rules for NAT. Also testing policy rule options " ro="False">
         <NAT id="id3AFB66C7" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id3AFB66C8" disabled="False" position="0" action="Translate" comment="">
+          <NATRule id="id3AFB66C8" disabled="False" group="" position="0" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2256,14 +2226,17 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule id="id3AFB66D6" disabled="False" position="1" action="Translate" comment="">
+          <NATRule id="id3AFB66D6" disabled="False" group="" position="1" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="id3B4572AF"/>
@@ -2283,14 +2256,17 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule id="id3DE9CA86" disabled="False" position="2" action="Translate" comment="">
+          <NATRule id="id3DE9CA86" disabled="False" group="" position="2" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2310,12 +2286,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3DE9CD88" disabled="False" position="3" action="Translate" comment="">
+          <NATRule id="id3DE9CD88" disabled="False" group="" position="3" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2334,12 +2313,15 @@
             <TSrv neg="False">
               <ServiceRef ref="tcp-SSH"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3DEA6375" disabled="False" position="4" action="Translate" comment="">
+          <NATRule id="id3DEA6375" disabled="False" group="" position="4" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2358,12 +2340,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3CABE6DF" disabled="False" position="5" action="Translate" comment="">
+          <NATRule id="id3CABE6DF" disabled="False" group="" position="5" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2383,12 +2368,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3AFB69BD" disabled="False" position="6" action="Translate" comment="">
+          <NATRule id="id3AFB69BD" disabled="False" group="" position="6" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2408,12 +2396,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3DEA6769" disabled="False" position="7" action="Translate" comment="load balancing rule">
+          <NATRule id="id3DEA6769" disabled="False" group="" position="7" action="Translate" comment="load balancing rule">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2434,12 +2425,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3DEA8105" disabled="False" position="8" action="Translate" comment="load balancing rule">
+          <NATRule id="id3DEA8105" disabled="False" group="" position="8" action="Translate" comment="load balancing rule">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2458,12 +2452,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D265545" disabled="False" position="9" action="Translate" comment="">
+          <NATRule id="id3D265545" disabled="False" group="" position="9" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2482,12 +2479,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D265556" disabled="False" position="10" action="Translate" comment="">
+          <NATRule id="id3D265556" disabled="False" group="" position="10" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2506,12 +2506,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3BEEF6D2" disabled="False" position="11" action="Translate" comment="">
+          <NATRule id="id3BEEF6D2" disabled="False" group="" position="11" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2530,12 +2533,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3BD67563" disabled="False" position="12" action="Translate" comment="">
+          <NATRule id="id3BD67563" disabled="False" group="" position="12" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="host-hostB"/>
             </OSrc>
@@ -2554,14 +2560,17 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule id="id3BD6757E" disabled="True" position="13" action="Translate" comment="">
+          <NATRule id="id3BD6757E" disabled="True" group="" position="13" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2580,12 +2589,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3B66568B" disabled="False" position="14" action="Translate" comment="NETMAP ">
+          <NATRule id="id3B66568B" disabled="False" group="" position="14" action="Translate" comment="NETMAP ">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2604,12 +2616,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3B6656EF" disabled="True" position="15" action="Translate" comment="NETMAP">
+          <NATRule id="id3B6656EF" disabled="True" group="" position="15" action="Translate" comment="NETMAP">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2628,12 +2643,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3AFB69F7" disabled="False" position="16" action="Translate" comment="">
+          <NATRule id="id3AFB69F7" disabled="False" group="" position="16" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2652,12 +2670,15 @@
             <TSrv neg="False">
               <ServiceRef ref="id3B20468D"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3B7313C4" disabled="False" position="17" action="Translate" comment="">
+          <NATRule id="id3B7313C4" disabled="False" group="" position="17" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2676,12 +2697,15 @@
             <TSrv neg="False">
               <ServiceRef ref="tcp-SMTP"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3DF6D103" disabled="False" position="18" action="Translate" comment="">
+          <NATRule id="id3DF6D103" disabled="False" group="" position="18" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2700,12 +2724,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3DF6D242" disabled="False" position="19" action="Translate" comment="">
+          <NATRule id="id3DF6D242" disabled="False" group="" position="19" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2725,15 +2752,18 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
         </NAT>
         <Policy id="id3AFB66E4" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id41D4F848" disabled="False" log="False" position="0" action="Accept" direction="Inbound" comment="">
+          <PolicyRule id="id41D4F848" disabled="False" group="" log="False" position="0" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -2750,11 +2780,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id463FF6C410755" disabled="False" log="False" position="1" action="Accept" direction="Inbound" comment="">
+          <PolicyRule id="id463FF6C410755" disabled="False" group="" log="False" position="1" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -2771,13 +2800,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4640031510755" disabled="False" log="False" position="2" action="Accept" direction="Inbound" comment="">
+          <PolicyRule id="id4640031510755" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -2794,13 +2821,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AFB6708" disabled="False" log="True" position="3" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
+          <PolicyRule id="id3AFB6708" disabled="False" group="" log="True" position="3" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3AFB66C6"/>
@@ -2814,19 +2839,16 @@
             <Itf neg="False">
               <ObjectRef ref="id3AFB6706"/>
             </Itf>
-            
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
               <Option name="log_prefix">Iface: %I RULE %N -- %A **</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AFB6710" disabled="False" log="True" position="4" action="Deny" direction="Outbound" comment="Anti-spoofing rule">
+          <PolicyRule id="id3AFB6710" disabled="False" group="" log="True" position="4" action="Deny" direction="Outbound" comment="Anti-spoofing rule">
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3AFB66C6"/>
@@ -2840,19 +2862,16 @@
             <Itf neg="False">
               <ObjectRef ref="id3AFB6706"/>
             </Itf>
-            
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
               <Option name="log_prefix">Iface: %I RULE %N -- %A **</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AFB66E5" disabled="False" log="True" position="5" action="Deny" direction="Both" comment="block fragments">
+          <PolicyRule id="id3AFB66E5" disabled="False" group="" log="True" position="5" action="Deny" direction="Both" comment="block fragments">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -2869,14 +2888,12 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B0C6FD2" disabled="False" log="True" position="6" action="Reject" direction="Both" comment="sends TCP RST and makes custom record in the log">
+          <PolicyRule id="id3B0C6FD2" disabled="False" group="" log="True" position="6" action="Reject" direction="Both" comment="sends TCP RST and makes custom record in the log">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -2896,16 +2913,14 @@
               <Option name="action_on_reject">TCP RST</Option>
               <Option name="ipf_keep_frags">False</Option>
               <Option name="ipf_return_icmp_as_dest">False</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
               <Option name="log_prefix">IDENT</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3D333A66" disabled="False" log="True" position="7" action="Reject" direction="Both" comment="sends TCP RST and makes custom record in the log">
+          <PolicyRule id="id3D333A66" disabled="False" group="" log="True" position="7" action="Reject" direction="Both" comment="sends TCP RST and makes custom record in the log">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -2922,19 +2937,17 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="ipf_keep_frags">False</Option>
               <Option name="ipf_return_icmp_as_dest">False</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
               <Option name="log_prefix">IDENT</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3D8FF63F" disabled="False" log="False" position="8" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3D8FF63F" disabled="False" group="" log="False" position="8" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id3B4572AF"/>
               <ObjectRef ref="id3D8FF5EC"/>
@@ -2952,11 +2965,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3D8FF660" disabled="False" log="False" position="9" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3D8FF660" disabled="False" group="" log="False" position="9" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id3B19C5EB"/>
             </Src>
@@ -2974,11 +2986,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AFB66EF" disabled="False" log="False" position="10" action="Accept" direction="Both" comment="'masquerading' rule">
+          <PolicyRule id="id3AFB66EF" disabled="False" group="" log="False" position="10" action="Accept" direction="Both" comment="'masquerading' rule">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -2995,13 +3006,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="id"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3C447B8D" disabled="False" log="True" position="11" action="Accept" direction="Both" comment="host-fw2 has the same address as &#10;        one of the firewall's interfaces">
+          <PolicyRule id="id3C447B8D" disabled="False" group="" log="True" position="11" action="Accept" direction="Both" comment="host-fw2 has the same address as &#10;        one of the firewall's interfaces">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3018,11 +3027,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3C447BCB" disabled="False" log="True" position="12" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3C447BCB" disabled="False" group="" log="True" position="12" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3039,11 +3047,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AFB66F9" disabled="False" log="True" position="13" action="Deny" direction="Both" comment="'catch all' rule">
+          <PolicyRule id="id3AFB66F9" disabled="False" group="" log="True" position="13" action="Deny" direction="Both" comment="'catch all' rule">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3060,12 +3067,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -3103,26 +3108,26 @@
           <Option name="action_on_reject">ICMP net unreachable</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="eliminate_duplicates">True</Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
-          <Option name="freebsd_path_ipf"/>
-          <Option name="freebsd_path_ipnat"/>
-          <Option name="freebsd_path_sysctl"/>
-          <Option name="id"/>
+          <Option name="freebsd_path_ipf"></Option>
+          <Option name="freebsd_path_ipnat"></Option>
+          <Option name="freebsd_path_sysctl"></Option>
+          <Option name="id"></Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="ipf_log_body">False</Option>
-          <Option name="ipf_log_facility"/>
-          <Option name="ipf_log_level"/>
+          <Option name="ipf_log_facility"></Option>
+          <Option name="ipf_log_level"></Option>
           <Option name="ipf_log_or_block">False</Option>
           <Option name="ipf_nat_ftp_proxy">True</Option>
           <Option name="ipf_nat_h323_proxy">True</Option>
@@ -3158,17 +3163,17 @@
           <Option name="pf_return_icmp_as_dest">True</Option>
           <Option name="platform">iptables</Option>
           <Option name="proxy_arp">True</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="use_ip_tool">True</Option>
           <Option name="use_numeric_log_levels">False</Option>
         </FirewallOptions>
       </Firewall>
       <Firewall id="id3B0C6380" host_OS="freebsd" lastCompiled="0" lastInstalled="0" lastModified="0" platform="ipfw" name="firewall4" comment="this object is used to test a configuration where firewall has dynamic address " ro="False">
         <NAT id="id3B0C6381" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id3B0C6382" disabled="False" position="0" action="Translate" comment="">
+          <NATRule id="id3B0C6382" disabled="False" group="" position="0" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="host-hostA"/>
             </OSrc>
@@ -3187,14 +3192,17 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule id="id3D758531" disabled="False" position="1" action="Translate" comment="">
+          <NATRule id="id3D758531" disabled="False" group="" position="1" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="host-hostA"/>
             </OSrc>
@@ -3213,14 +3221,17 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule id="id3D75869D" disabled="False" position="2" action="Translate" comment="">
+          <NATRule id="id3D75869D" disabled="False" group="" position="2" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="host-hostA"/>
             </OSrc>
@@ -3239,14 +3250,17 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule id="id3D7586D1" disabled="False" position="3" action="Translate" comment="">
+          <NATRule id="id3D7586D1" disabled="False" group="" position="3" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="host-hostA"/>
             </OSrc>
@@ -3265,14 +3279,17 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule id="id3B0C6390" disabled="True" position="4" action="Translate" comment="negation in NAT is not supported&#10;in ipf yet">
+          <NATRule id="id3B0C6390" disabled="True" group="" position="4" action="Translate" comment="negation in NAT is not supported&#10;in ipf yet">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -3291,14 +3308,17 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule id="id3B202AFF" disabled="False" position="5" action="Translate" comment="">
+          <NATRule id="id3B202AFF" disabled="False" group="" position="5" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -3317,12 +3337,15 @@
             <TSrv neg="False">
               <ServiceRef ref="tcp-SSH"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D757CC5" disabled="False" position="6" action="Translate" comment="">
+          <NATRule id="id3D757CC5" disabled="False" group="" position="6" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -3342,12 +3365,15 @@
             <TSrv neg="False">
               <ServiceRef ref="id3B4FF09A"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D757E01" disabled="False" position="7" action="Translate" comment="">
+          <NATRule id="id3D757E01" disabled="False" group="" position="7" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -3367,12 +3393,15 @@
             <TSrv neg="False">
               <ServiceRef ref="id3B4FF09A"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D757F29" disabled="False" position="8" action="Translate" comment="">
+          <NATRule id="id3D757F29" disabled="False" group="" position="8" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -3392,15 +3421,18 @@
             <TSrv neg="False">
               <ServiceRef ref="id3B4FF09A"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
         </NAT>
         <Policy id="id3B0C639E" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id3B0C63E3" disabled="False" log="True" position="13" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
+          <PolicyRule id="id3B0C63E3" disabled="False" group="" log="True" position="13" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B0C6380"/>
@@ -3414,15 +3446,12 @@
             <Itf neg="False">
               <ObjectRef ref="id3B0C63E1"/>
             </Itf>
-            
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B0C63EB" disabled="False" log="True" position="14" action="Deny" direction="Outbound" comment="Anti-spoofing rule">
+          <PolicyRule id="id3B0C63EB" disabled="False" group="" log="True" position="14" action="Deny" direction="Outbound" comment="Anti-spoofing rule">
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B0C6380"/>
@@ -3436,15 +3465,12 @@
             <Itf neg="False">
               <ObjectRef ref="id3B0C63E1"/>
             </Itf>
-            
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B54C977" disabled="False" log="True" position="15" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3B54C977" disabled="False" group="" log="True" position="15" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3457,15 +3483,12 @@
             <Itf neg="False">
               <ObjectRef ref="id3B0C63E1"/>
             </Itf>
-            
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B54F071" disabled="False" log="True" position="16" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3B54F071" disabled="False" group="" log="True" position="16" action="Deny" direction="Both" comment="">
             <Src neg="True">
               <ObjectRef ref="id3B022266"/>
             </Src>
@@ -3478,15 +3501,12 @@
             <Itf neg="False">
               <ObjectRef ref="id3B0C63E1"/>
             </Itf>
-            
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B0C639F" disabled="False" log="True" position="4" action="Accept" direction="Both" comment="hostF has the same IP address as firewal.">
+          <PolicyRule id="id3B0C639F" disabled="False" group="" log="True" position="4" action="Accept" direction="Both" comment="hostF has the same IP address as firewal.">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3503,13 +3523,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="id"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B0C63A9" disabled="False" log="True" position="5" action="Deny" direction="Both" comment="testing negation in the policy rule">
+          <PolicyRule id="id3B0C63A9" disabled="False" group="" log="True" position="5" action="Deny" direction="Both" comment="testing negation in the policy rule">
             <Src neg="True">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
@@ -3527,14 +3545,12 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B0C63B4" disabled="False" log="True" position="6" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3B0C63B4" disabled="False" group="" log="True" position="6" action="Deny" direction="Both" comment="">
             <Src neg="True">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
@@ -3552,14 +3568,12 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B0C63BF" disabled="True" log="True" position="7" action="Deny" direction="Both" comment="testing negation in service field">
+          <PolicyRule id="id3B0C63BF" disabled="True" group="" log="True" position="7" action="Deny" direction="Both" comment="testing negation in service field">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3578,14 +3592,12 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B0C63CB" disabled="False" log="False" position="8" action="Accept" direction="Both" comment="'masquerading' rule">
+          <PolicyRule id="id3B0C63CB" disabled="False" group="" log="False" position="8" action="Accept" direction="Both" comment="'masquerading' rule">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -3602,13 +3614,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="id"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3D85069A" disabled="True" log="True" position="9" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3D85069A" disabled="True" group="" log="True" position="9" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3626,11 +3636,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3B0C63D5" disabled="False" log="True" position="10" action="Deny" direction="Both" comment="'catch all' rule">
+          <PolicyRule id="id3B0C63D5" disabled="False" group="" log="True" position="10" action="Deny" direction="Both" comment="'catch all' rule">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3647,12 +3656,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -3690,8 +3697,8 @@
           <Option name="action_on_reject">ICMP net unreachable</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="eliminate_duplicates">True</Option>
@@ -3700,16 +3707,16 @@
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="freebsd_path_ipf">/usr/sbin/ipf</Option>
           <Option name="freebsd_path_ipnat">/usr/sbin/ipnat</Option>
-          <Option name="freebsd_path_sysctl"/>
-          <Option name="id"/>
+          <Option name="freebsd_path_sysctl"></Option>
+          <Option name="id"></Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="ipf_log_body">False</Option>
-          <Option name="ipf_log_facility"/>
-          <Option name="ipf_log_level"/>
+          <Option name="ipf_log_facility"></Option>
+          <Option name="ipf_log_level"></Option>
           <Option name="ipf_log_or_block">False</Option>
           <Option name="ipf_nat_ftp_proxy">False</Option>
           <Option name="ipf_nat_raudio_proxy">False</Option>
@@ -3726,7 +3733,7 @@
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
@@ -3736,10 +3743,10 @@
           <Option name="pass_all_out">False</Option>
           <Option name="platform">iptables</Option>
           <Option name="proxy_arp">False</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="use_numeric_log_levels">False</Option>
         </FirewallOptions>
       </Firewall>
@@ -3748,7 +3755,7 @@
           <RuleSetOptions/>
         </NAT>
         <Policy id="id3C69BD51" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id3C69BDE1" disabled="False" log="True" position="17" action="Deny" direction="Inbound" comment="">
+          <PolicyRule id="id3C69BDE1" disabled="False" group="" log="True" position="17" action="Deny" direction="Inbound" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3765,13 +3772,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3CF5B373" disabled="False" log="True" position="18" action="Deny" direction="Inbound" comment="">
+          <PolicyRule id="id3CF5B373" disabled="False" group="" log="True" position="18" action="Deny" direction="Inbound" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3788,13 +3793,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3C69BF13" disabled="False" log="False" position="2" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3C69BF13" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3811,9 +3814,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -3851,25 +3853,25 @@
           <Option name="action_on_reject">ICMP net unreachable</Option>
           <Option name="check_shading">True</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="eliminate_duplicates">True</Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
-          <Option name="freebsd_path_ipf"/>
-          <Option name="freebsd_path_ipnat"/>
-          <Option name="freebsd_path_sysctl"/>
+          <Option name="freebsd_path_ipf"></Option>
+          <Option name="freebsd_path_ipnat"></Option>
+          <Option name="freebsd_path_sysctl"></Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="ipf_log_body">False</Option>
-          <Option name="ipf_log_facility"/>
-          <Option name="ipf_log_level"/>
+          <Option name="ipf_log_facility"></Option>
+          <Option name="ipf_log_level"></Option>
           <Option name="ipf_log_or_block">False</Option>
           <Option name="ipf_nat_ftp_proxy">False</Option>
           <Option name="ipf_nat_raudio_proxy">False</Option>
@@ -3886,7 +3888,7 @@
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
@@ -3896,10 +3898,10 @@
           <Option name="pass_all_out">False</Option>
           <Option name="platform">iptables</Option>
           <Option name="proxy_arp">False</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="use_ip_tool">False</Option>
           <Option name="use_numeric_log_levels">False</Option>
         </FirewallOptions>
@@ -3909,7 +3911,7 @@
           <RuleSetOptions/>
         </NAT>
         <Policy id="id3AF5A2BC" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id3BD8ECD0" disabled="False" log="True" position="19" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3BD8ECD0" disabled="False" group="" log="True" position="19" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id3AF5A2BA"/>
             </Src>
@@ -3922,13 +3924,11 @@
             <Itf neg="False">
               <ObjectRef ref="id3AF5A2CB"/>
             </Itf>
-            
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AFB70C7" disabled="False" log="False" position="20" action="Accept" direction="Inbound" comment="allow everything on loopback">
+          <PolicyRule id="id3AFB70C7" disabled="False" group="" log="False" position="20" action="Accept" direction="Inbound" comment="allow everything on loopback">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3941,13 +3941,11 @@
             <Itf neg="False">
               <ObjectRef ref="id3AFB7090"/>
             </Itf>
-            
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AFB70CF" disabled="False" log="False" position="21" action="Accept" direction="Outbound" comment="allow everything on loopback">
+          <PolicyRule id="id3AFB70CF" disabled="False" group="" log="False" position="21" action="Accept" direction="Outbound" comment="allow everything on loopback">
             <Src neg="False">
               <ObjectRef ref="id3AF5A2BA"/>
             </Src>
@@ -3960,13 +3958,11 @@
             <Itf neg="False">
               <ObjectRef ref="id3AFB7090"/>
             </Itf>
-            
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3BD8ECC6" disabled="False" log="True" position="22" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3BD8ECC6" disabled="False" group="" log="True" position="22" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id3AF5A2BA"/>
             </Src>
@@ -3979,13 +3975,11 @@
             <Itf neg="False">
               <ObjectRef ref="id3AFB7090"/>
             </Itf>
-            
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AF5A74B" disabled="False" log="True" position="4" action="Deny" direction="Both" comment="block fragments">
+          <PolicyRule id="id3AF5A74B" disabled="False" group="" log="True" position="4" action="Deny" direction="Both" comment="block fragments">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4002,13 +3996,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AF5A73A" disabled="False" log="False" position="5" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3AF5A73A" disabled="False" group="" log="False" position="5" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4030,11 +4022,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AF5A757" disabled="False" log="False" position="6" action="Accept" direction="Both" comment="allow all outgoing connections">
+          <PolicyRule id="id3AF5A757" disabled="False" group="" log="False" position="6" action="Accept" direction="Both" comment="allow all outgoing connections">
             <Src neg="False">
               <ObjectRef ref="id3AF5A2BA"/>
             </Src>
@@ -4051,11 +4042,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3AF5A762" disabled="False" log="True" position="7" action="Deny" direction="Both" comment="'catch all' rule">
+          <PolicyRule id="id3AF5A762" disabled="False" group="" log="True" position="7" action="Deny" direction="Both" comment="'catch all' rule">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4072,11 +4062,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -4102,24 +4090,24 @@
           <Option name="action_on_reject">ICMP host prohibited</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
-          <Option name="freebsd_path_ipf"/>
-          <Option name="freebsd_path_ipnat"/>
-          <Option name="freebsd_path_sysctl"/>
+          <Option name="freebsd_path_ipf"></Option>
+          <Option name="freebsd_path_ipnat"></Option>
+          <Option name="freebsd_path_sysctl"></Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="ipf_log_body">False</Option>
-          <Option name="ipf_log_facility"/>
-          <Option name="ipf_log_level"/>
+          <Option name="ipf_log_facility"></Option>
+          <Option name="ipf_log_level"></Option>
           <Option name="ipf_log_or_block">False</Option>
           <Option name="ipf_nat_ftp_proxy">False</Option>
           <Option name="ipf_nat_raudio_proxy">False</Option>
@@ -4134,9 +4122,9 @@
           <Option name="log_all_dropped">False</Option>
           <Option name="log_ip_opt">False</Option>
           <Option name="log_level">debug</Option>
-          <Option name="log_limit_suffix"/>
+          <Option name="log_limit_suffix"></Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">False</Option>
@@ -4145,17 +4133,17 @@
           <Option name="no_optimisation">False</Option>
           <Option name="pass_all_out">False</Option>
           <Option name="platform">iptables</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="use_ip_tool">False</Option>
           <Option name="use_numeric_log_levels">False</Option>
         </FirewallOptions>
       </Firewall>
       <Firewall id="id3D582236" host_OS="freebsd" lastCompiled="0" lastInstalled="0" lastModified="0" platform="ipfw" name="firewall8" comment="" ro="False">
         <NAT id="id3D58223A" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id3D58237B" disabled="False" position="0" action="Translate" comment="">
+          <NATRule id="id3D58237B" disabled="False" group="" position="0" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -4174,12 +4162,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D5823A5" disabled="False" position="1" action="Translate" comment="">
+          <NATRule id="id3D5823A5" disabled="False" group="" position="1" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -4198,12 +4189,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D5823B9" disabled="False" position="2" action="Translate" comment="">
+          <NATRule id="id3D5823B9" disabled="False" group="" position="2" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -4222,12 +4216,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D58245E" disabled="False" position="3" action="Translate" comment="">
+          <NATRule id="id3D58245E" disabled="False" group="" position="3" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4246,12 +4243,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D58236D" disabled="False" position="4" action="Translate" comment="">
+          <NATRule id="id3D58236D" disabled="False" group="" position="4" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4270,12 +4270,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D58235F" disabled="False" position="5" action="Translate" comment="">
+          <NATRule id="id3D58235F" disabled="False" group="" position="5" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4294,12 +4297,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D582472" disabled="False" position="6" action="Translate" comment="">
+          <NATRule id="id3D582472" disabled="False" group="" position="6" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4318,12 +4324,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D58249D" disabled="False" position="7" action="Translate" comment="">
+          <NATRule id="id3D58249D" disabled="False" group="" position="7" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4342,12 +4351,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3D5825CC" disabled="False" position="8" action="Translate" comment="">
+          <NATRule id="id3D5825CC" disabled="False" group="" position="8" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4366,15 +4378,18 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
         </NAT>
         <Policy id="id3D582239" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id3D5822AA" disabled="False" log="False" position="0" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3D5822AA" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4391,11 +4406,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3D5822B5" disabled="False" log="False" position="1" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3D5822B5" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4412,11 +4426,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3D582294" disabled="False" log="False" position="2" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3D582294" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4433,11 +4446,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3D58228A" disabled="False" log="False" position="3" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3D58228A" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4454,11 +4466,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3D5822A0" disabled="False" log="True" position="4" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3D5822A0" disabled="False" group="" log="True" position="4" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4475,11 +4486,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -4503,20 +4512,20 @@
         <FirewallOptions>
           <Option name="action_on_reject">ICMP host prohibited</Option>
           <Option name="check_shading">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="debug">False</Option>
           <Option name="eliminate_duplicates">True</Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="freebsd_ip_forward">1</Option>
-          <Option name="freebsd_path_ipf"/>
-          <Option name="freebsd_path_ipnat"/>
-          <Option name="freebsd_path_sysctl"/>
+          <Option name="freebsd_path_ipf"></Option>
+          <Option name="freebsd_path_ipnat"></Option>
+          <Option name="freebsd_path_sysctl"></Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="in_out_code">True</Option>
           <Option name="ipf_log_body">False</Option>
-          <Option name="ipf_log_facility"/>
-          <Option name="ipf_log_level"/>
+          <Option name="ipf_log_facility"></Option>
+          <Option name="ipf_log_level"></Option>
           <Option name="ipf_log_or_block">False</Option>
           <Option name="ipf_nat_ftp_proxy">False</Option>
           <Option name="ipf_nat_raudio_proxy">False</Option>
@@ -4524,14 +4533,14 @@
           <Option name="ipf_return_icmp_as_dest">False</Option>
           <Option name="manage_virtual_addr">False</Option>
           <Option name="pass_all_out">False</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
         </FirewallOptions>
       </Firewall>
       <Firewall id="id3DF3D0AD" host_OS="freebsd" lastCompiled="0" lastInstalled="0" lastModified="1230496425" platform="ipfw" name="firewall9" comment="" ro="False">
         <NAT id="id3DF3D0AE" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id3DF3D0AF" disabled="False" position="0" action="Translate" comment="">
+          <NATRule id="id3DF3D0AF" disabled="False" group="" position="0" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -4550,12 +4559,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3DF3D0BD" disabled="False" position="1" action="Translate" comment="">
+          <NATRule id="id3DF3D0BD" disabled="False" group="" position="1" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -4574,12 +4586,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3DF3D0CB" disabled="False" position="2" action="Translate" comment="">
+          <NATRule id="id3DF3D0CB" disabled="False" group="" position="2" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -4598,12 +4613,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3DF3D0D9" disabled="False" position="3" action="Translate" comment="">
+          <NATRule id="id3DF3D0D9" disabled="False" group="" position="3" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4622,12 +4640,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3DF3D0E7" disabled="False" position="4" action="Translate" comment="">
+          <NATRule id="id3DF3D0E7" disabled="False" group="" position="4" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4646,12 +4667,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3DF3D0F5" disabled="False" position="5" action="Translate" comment="">
+          <NATRule id="id3DF3D0F5" disabled="False" group="" position="5" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4670,12 +4694,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3DF3D103" disabled="False" position="6" action="Translate" comment="">
+          <NATRule id="id3DF3D103" disabled="False" group="" position="6" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4694,12 +4721,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3DF3D111" disabled="False" position="7" action="Translate" comment="">
+          <NATRule id="id3DF3D111" disabled="False" group="" position="7" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4718,12 +4748,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id3DF3D11F" disabled="False" position="8" action="Translate" comment="">
+          <NATRule id="id3DF3D11F" disabled="False" group="" position="8" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4742,15 +4775,18 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
         </NAT>
         <Policy id="id3DF3D12D" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id3DF3DFB0" disabled="False" log="True" position="0" action="Deny" direction="Inbound" comment="">
+          <PolicyRule id="id3DF3DFB0" disabled="False" group="" log="True" position="0" action="Deny" direction="Inbound" comment="">
             <Src neg="True">
               <ObjectRef ref="id3B665643"/>
             </Src>
@@ -4767,13 +4803,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3DF3E09E" disabled="False" log="False" position="1" action="Accept" direction="Inbound" comment="">
+          <PolicyRule id="id3DF3E09E" disabled="False" group="" log="False" position="1" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
               <ObjectRef ref="id3B665643"/>
             </Src>
@@ -4791,11 +4825,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3DF3D16E" disabled="False" log="False" position="2" action="Accept" direction="Inbound" comment="">
+          <PolicyRule id="id3DF3D16E" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="">
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3DF3D0AD"/>
@@ -4813,11 +4846,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3E5F2E4C" disabled="False" log="False" position="3" action="Accounting" direction="Both" comment="">
+          <PolicyRule id="id3E5F2E4C" disabled="False" group="" log="False" position="3" action="Accounting" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4834,13 +4866,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3E5F2E42" disabled="False" log="True" position="4" action="Accounting" direction="Both" comment="">
+          <PolicyRule id="id3E5F2E42" disabled="False" group="" log="True" position="4" action="Accounting" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4857,13 +4887,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3DF3D12E" disabled="False" log="False" position="5" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3DF3D12E" disabled="False" group="" log="False" position="5" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4880,11 +4908,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3DF3D563" disabled="False" log="False" position="6" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3DF3D563" disabled="False" group="" log="False" position="6" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -4901,11 +4928,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3F162CE1" disabled="False" log="False" position="7" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3F162CE1" disabled="False" group="" log="False" position="7" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4922,14 +4948,12 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3DF3D156" disabled="False" log="True" position="8" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3DF3D156" disabled="False" group="" log="True" position="8" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4946,11 +4970,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -4973,20 +4995,20 @@
         <FirewallOptions>
           <Option name="action_on_reject">ICMP host prohibited</Option>
           <Option name="check_shading">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="debug">False</Option>
           <Option name="eliminate_duplicates">True</Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="freebsd_ip_forward">1</Option>
-          <Option name="freebsd_path_ipf"/>
-          <Option name="freebsd_path_ipnat"/>
-          <Option name="freebsd_path_sysctl"/>
+          <Option name="freebsd_path_ipf"></Option>
+          <Option name="freebsd_path_ipnat"></Option>
+          <Option name="freebsd_path_sysctl"></Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="in_out_code">True</Option>
           <Option name="ipf_log_body">False</Option>
-          <Option name="ipf_log_facility"/>
-          <Option name="ipf_log_level"/>
+          <Option name="ipf_log_facility"></Option>
+          <Option name="ipf_log_level"></Option>
           <Option name="ipf_log_or_block">False</Option>
           <Option name="ipf_nat_ftp_proxy">False</Option>
           <Option name="ipf_nat_h323_proxy">False</Option>
@@ -4996,9 +5018,9 @@
           <Option name="ipf_return_icmp_as_dest">False</Option>
           <Option name="manage_virtual_addr">False</Option>
           <Option name="pass_all_out">False</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
         </FirewallOptions>
       </Firewall>
       <Firewall id="id3E51AF8E" host_OS="macosx" lastCompiled="0" lastInstalled="0" lastModified="0" platform="ipfw" version="" name="mac" comment="" ro="False">
@@ -5006,7 +5028,7 @@
           <RuleSetOptions/>
         </NAT>
         <Policy id="id3E51AF91" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id3E51AFA1" disabled="False" log="False" position="0" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3E51AFA1" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5023,11 +5045,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id41D4F998" disabled="False" log="False" position="1" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id41D4F998" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5044,11 +5065,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3E51B0B0" disabled="False" log="True" position="2" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3E51B0B0" disabled="False" group="" log="True" position="2" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5066,13 +5086,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3E51B025" disabled="False" log="False" position="3" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3E51B025" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5092,11 +5110,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3E51BD2E" disabled="False" log="False" position="4" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3E51BD2E" disabled="False" group="" log="False" position="4" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id3E51AF8E"/>
             </Src>
@@ -5116,11 +5133,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3E51B010" disabled="False" log="True" position="5" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3E51B010" disabled="False" group="" log="True" position="5" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5137,11 +5153,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -5164,20 +5178,20 @@
         <FirewallOptions>
           <Option name="action_on_reject">ICMP host prohibited</Option>
           <Option name="check_shading">True</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="debug">True</Option>
           <Option name="eliminate_duplicates">True</Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="freebsd_ip_forward">1</Option>
-          <Option name="freebsd_path_ipf"/>
-          <Option name="freebsd_path_ipnat"/>
-          <Option name="freebsd_path_sysctl"/>
+          <Option name="freebsd_path_ipf"></Option>
+          <Option name="freebsd_path_ipnat"></Option>
+          <Option name="freebsd_path_sysctl"></Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="in_out_code">True</Option>
           <Option name="ipf_log_body">False</Option>
-          <Option name="ipf_log_facility"/>
-          <Option name="ipf_log_level"/>
+          <Option name="ipf_log_facility"></Option>
+          <Option name="ipf_log_level"></Option>
           <Option name="ipf_log_or_block">False</Option>
           <Option name="ipf_nat_ftp_proxy">False</Option>
           <Option name="ipf_nat_h323_proxy">False</Option>
@@ -5189,18 +5203,18 @@
           <Option name="macosx_ip_forward">1</Option>
           <Option name="macosx_ip_redirect">0</Option>
           <Option name="macosx_ip_sourceroute">0</Option>
-          <Option name="macosx_path_ipfw"/>
-          <Option name="macosx_path_sysctl"/>
+          <Option name="macosx_path_ipfw"></Option>
+          <Option name="macosx_path_sysctl"></Option>
           <Option name="manage_virtual_addr">False</Option>
           <Option name="pass_all_out">False</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
         </FirewallOptions>
       </Firewall>
       <Firewall id="id43867C1018346" host_OS="freebsd" lastCompiled="0" lastInstalled="0" lastModified="0" platform="ipfw" version="" name="firewall33" comment="testing DNSName object" ro="False">
         <NAT id="id43867C4818346" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id43876E2618346" disabled="False" position="0" action="Translate" comment="">
+          <NATRule id="id43876E2618346" disabled="False" group="" position="0" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -5219,12 +5233,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id43876E5218346" disabled="False" position="1" action="Translate" comment="">
+          <NATRule id="id43876E5218346" disabled="False" group="" position="1" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -5243,12 +5260,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id43876E6918346" disabled="False" position="2" action="Translate" comment="">
+          <NATRule id="id43876E6918346" disabled="False" group="" position="2" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -5268,12 +5288,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id43876E7B18346" disabled="False" position="3" action="Translate" comment="">
+          <NATRule id="id43876E7B18346" disabled="False" group="" position="3" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -5293,15 +5316,18 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
         </NAT>
         <Policy id="id43867C1618346" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id43867C2418346" disabled="False" log="False" position="0" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id43867C2418346" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id43869E8C18346"/>
             </Src>
@@ -5318,11 +5344,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id43869E9018346" disabled="False" log="False" position="1" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id43869E9018346" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id43869E8D18346"/>
             </Src>
@@ -5339,11 +5364,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id43869E9E18346" disabled="False" log="False" position="2" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id43869E9E18346" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id43869E8E18346"/>
             </Src>
@@ -5360,11 +5384,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id43869EAA18346" disabled="False" log="False" position="3" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id43869EAA18346" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id43869E8F18346"/>
             </Src>
@@ -5381,11 +5404,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4386E38318346" disabled="False" log="False" position="4" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id4386E38318346" disabled="False" group="" log="False" position="4" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5402,13 +5424,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4386E37718346" disabled="False" log="False" position="5" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id4386E37718346" disabled="False" group="" log="False" position="5" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5425,13 +5445,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id43867C3018346" disabled="False" log="False" position="6" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id43867C3018346" disabled="False" group="" log="False" position="6" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5448,11 +5466,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4386C10D18346" disabled="False" log="False" position="7" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4386C10D18346" disabled="False" group="" log="False" position="7" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5469,11 +5486,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id438728A918346" disabled="False" log="False" position="8" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id438728A918346" disabled="False" group="" log="False" position="8" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5491,11 +5507,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id438728BA18346" disabled="False" log="False" position="9" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id438728BA18346" disabled="False" group="" log="False" position="9" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5513,11 +5528,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id438728CD18346" disabled="False" log="False" position="10" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id438728CD18346" disabled="False" group="" log="False" position="10" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5535,11 +5549,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id43867C3C18346" disabled="False" log="True" position="11" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id43867C3C18346" disabled="False" group="" log="True" position="11" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5556,11 +5569,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -5587,50 +5598,50 @@
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="epilog_script"/>
-          <Option name="firewall_dir"/>
+          <Option name="epilog_script"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">False</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -5644,20 +5655,20 @@
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="platform">iptables</Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"/>
+          <Option name="prolog_script"></Option>
           <Option name="proxy_arp">False</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
-          <Option name="sshArgs"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -5670,7 +5681,7 @@
       </Firewall>
       <Firewall id="id43F7AAE423738" host_OS="freebsd" inactive="False" lastCompiled="1160203243" lastInstalled="0" lastModified="1160203225" platform="ipfw" version="" name="firewall34" comment="Testing actions Pipe, Classify, Custom" ro="False">
         <NAT id="id43F7AB2723738" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id43F7AB2823738" disabled="False" position="0" action="Translate" comment="">
+          <NATRule id="id43F7AB2823738" disabled="False" group="" position="0" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -5689,12 +5700,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id43F7AB3623738" disabled="False" position="1" action="Translate" comment="">
+          <NATRule id="id43F7AB3623738" disabled="False" group="" position="1" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -5713,12 +5727,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id43F7AB4423738" disabled="False" position="2" action="Translate" comment="">
+          <NATRule id="id43F7AB4423738" disabled="False" group="" position="2" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -5737,12 +5754,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id43F7AB5223738" disabled="False" position="3" action="Translate" comment="">
+          <NATRule id="id43F7AB5223738" disabled="False" group="" position="3" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -5761,12 +5781,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id43F7AB6023738" disabled="False" position="4" action="Translate" comment="">
+          <NATRule id="id43F7AB6023738" disabled="False" group="" position="4" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -5785,12 +5808,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id43F7AB6E23738" disabled="False" position="5" action="Translate" comment="">
+          <NATRule id="id43F7AB6E23738" disabled="False" group="" position="5" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -5809,12 +5835,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id43F7AB7C23738" disabled="False" position="6" action="Translate" comment="">
+          <NATRule id="id43F7AB7C23738" disabled="False" group="" position="6" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -5833,12 +5862,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id43F7AB8A23738" disabled="False" position="7" action="Translate" comment="">
+          <NATRule id="id43F7AB8A23738" disabled="False" group="" position="7" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -5857,12 +5889,15 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule id="id43F7AB9823738" disabled="False" position="8" action="Translate" comment="">
+          <NATRule id="id43F7AB9823738" disabled="False" group="" position="8" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -5881,15 +5916,18 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
         </NAT>
         <Policy id="id43F7AAEA23738" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id43F7AAEB23738" disabled="False" log="False" position="0" action="Pipe" direction="Both" comment="port 8668 is natd">
+          <PolicyRule id="id43F7AAEB23738" disabled="False" group="" log="False" position="0" action="Pipe" direction="Both" comment="port 8668 is natd">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -5906,35 +5944,33 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="classify_str"/>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="classify_str"></Option>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">Route through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">8668</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">Route through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
-              <Option name="tagvalue"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="tagvalue"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id45275D7A5394" disabled="False" log="False" position="1" action="Custom" direction="Both" comment="rule doing divert to natd (8668) should go before check-state&#10;">
+          <PolicyRule id="id45275D7A5394" disabled="False" group="" log="False" position="1" action="Custom" direction="Both" comment="rule doing divert to natd (8668) should go before check-state&#10;">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5951,34 +5987,32 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="classify_str"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="classify_str"></Option>
               <Option name="custom_str">check-state</Option>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">Route through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">Route through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id452299478881" disabled="False" log="False" position="2" action="Pipe" direction="Both" comment="">
+          <PolicyRule id="id452299478881" disabled="False" group="" log="False" position="2" action="Pipe" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -5995,21 +6029,19 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="classify_str"/>
-              <Option name="custom_str"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="classify_str"></Option>
+              <Option name="custom_str"></Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">1234</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="pf_classify_str"></Option>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
-              <Option name="tagvalue"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="tagvalue"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id43F7AC9D23738" disabled="False" log="False" position="3" action="Classify" direction="Both" comment="">
+          <PolicyRule id="id43F7AC9D23738" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -6026,22 +6058,23 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="classify_str"/>
-              <Option name="custom_str"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="classification">True</Option>
+              <Option name="classify_str"></Option>
+              <Option name="custom_str"></Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_method">1</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">2</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="pf_classify_str"></Option>
+              <Option name="routing">False</Option>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
-              <Option name="tagvalue"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="tagging">False</Option>
+              <Option name="tagvalue"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id43F7ACAE23738" disabled="False" log="False" position="4" action="Classify" direction="Both" comment="">
+          <PolicyRule id="id43F7ACAE23738" disabled="False" group="" log="False" position="4" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -6058,23 +6091,24 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="classify_str"/>
-              <Option name="custom_str"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="classification">True</Option>
+              <Option name="classify_str"></Option>
+              <Option name="custom_str"></Option>
               <Option name="ipfw_classify_method">1</Option>
               <Option name="ipfw_classify_port_num">1</Option>
               <Option name="ipfw_pipe_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">1</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="pf_classify_str"></Option>
+              <Option name="routing">False</Option>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
-              <Option name="tagvalue"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="tagging">False</Option>
+              <Option name="tagvalue"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id43F7C4D723738" disabled="False" log="True" position="5" action="Custom" direction="Both" comment="">
+          <PolicyRule id="id43F7C4D723738" disabled="False" group="" log="True" position="5" action="Custom" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -6091,20 +6125,18 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="classify_str"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="classify_str"></Option>
               <Option name="custom_str">prob .80</Option>
               <Option name="ipfw_pipe_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="pf_classify_str"></Option>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
-              <Option name="tagvalue"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="tagvalue"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id43F7AB1B23738" disabled="False" log="True" position="6" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id43F7AB1B23738" disabled="False" group="" log="True" position="6" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6121,11 +6153,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -6148,42 +6178,42 @@
         </Management>
         <FirewallOptions>
           <Option name="action_on_reject">ICMP host prohibited</Option>
-          <Option name="activationCmd"/>
+          <Option name="activationCmd"></Option>
           <Option name="add_check_state_rule">False</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">True</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">False</Option>
           <Option name="debug">False</Option>
           <Option name="eliminate_duplicates">True</Option>
-          <Option name="epilog_script"/>
+          <Option name="epilog_script"></Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="freebsd_ip_forward">1</Option>
-          <Option name="freebsd_path_ipf"/>
-          <Option name="freebsd_path_ipnat"/>
-          <Option name="freebsd_path_sysctl"/>
+          <Option name="freebsd_path_ipf"></Option>
+          <Option name="freebsd_path_ipnat"></Option>
+          <Option name="freebsd_path_sysctl"></Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="in_out_code">True</Option>
           <Option name="ipf_log_body">False</Option>
-          <Option name="ipf_log_facility"/>
-          <Option name="ipf_log_level"/>
+          <Option name="ipf_log_facility"></Option>
+          <Option name="ipf_log_level"></Option>
           <Option name="ipf_log_or_block">False</Option>
           <Option name="ipf_nat_ftp_proxy">False</Option>
           <Option name="ipf_nat_raudio_proxy">False</Option>
           <Option name="ipf_nat_rcmd_proxy">False</Option>
           <Option name="ipf_return_icmp_as_dest">False</Option>
           <Option name="manage_virtual_addr">False</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">False</Option>
-          <Option name="prolog_script"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
-          <Option name="sshArgs"/>
+          <Option name="prolog_script"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
+          <Option name="sshArgs"></Option>
         </FirewallOptions>
       </Firewall>
     </ObjectGroup>
@@ -6289,9 +6319,9 @@
         <ICMPService id="icmp-ping_reply" code="0" type="0" name="ping reply" comment="" ro="False"/>
       </ServiceGroup>
       <CustomService id="stdid14_1" name="ESTABLISHED" comment="This service matches all packets which are part of network connections established through the firewall, or connections 'related' to those established through the firewall. Term 'established' refers to the state tracking mechanism which exists inside iptables and other stateful firewalls and does not mean any particular combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful inspection module made appropriate record in the state table. Usually stateful firewalls keep track of network connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' describes packet belonging to a separate network connection, related to the session firewall is keeping track of. One example is FTP command and FTP data sessions." ro="False" protocol="any" address_family="ipv4">
-        <CustomServiceCommand platform="Undefined"/>
+        <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
         <CustomServiceCommand platform="iosacl">established</CustomServiceCommand>
-        <CustomServiceCommand platform="ipfilter"/>
+        <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
         <CustomServiceCommand platform="ipfw">established</CustomServiceCommand>
         <CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
       </CustomService>
diff --git a/test/ipt/rc.firewall.local b/test/ipt/rc.firewall.local
index e24a35a0e..2140e0a9e 100755
--- a/test/ipt/rc.firewall.local
+++ b/test/ipt/rc.firewall.local
@@ -4,7 +4,7 @@
 #
 #  Firewall Builder  fwb_ipt v4.2.1.ma_1
 #
-#  Generated Tue May  3 19:34:11 2011 PDT by vadim
+#  Generated Fri May  6 15:51:27 2011 PDT by vadim
 #
 # files: * rc.firewall.local /etc/rc.d//rc.firewall.local
 #
diff --git a/test/pf/pf_cluster_4_rc.conf.local b/test/pf/pf_cluster_4_rc.conf.local
index 04659e5e4..2c49ffaa2 100755
--- a/test/pf/pf_cluster_4_rc.conf.local
+++ b/test/pf/pf_cluster_4_rc.conf.local
@@ -3,7 +3,7 @@
 #
 #  Firewall Builder  fwb_pf v4.2.1.ma_1
 #
-#  Generated Fri May  6 15:05:37 2011 PDT by vadim
+#  Generated Fri May  6 15:44:13 2011 PDT by vadim
 #
 # files: * pf_cluster_4_rc.conf.local /etc/pf_cluster_4_rc.conf.local
 # files:   pf_cluster_4_pf.conf /etc/pf_cluster_4_pf.conf
diff --git a/test/pix/cluster-tests.fwb b/test/pix/cluster-tests.fwb
index 8480cea52..334d54775 100644
--- a/test/pix/cluster-tests.fwb
+++ b/test/pix/cluster-tests.fwb
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
-<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="20" lastModified="1269894581" id="root">
+<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="21" lastModified="1269894581" id="root">
   <Library id="syslib000" color="#d4f8ff" name="Standard" comment="Standard objects" ro="True">
     <AnyNetwork id="sysid0" name="Any" comment="Any Network" ro="False" address="0.0.0.0" netmask="0.0.0.0"/>
     <AnyIPService id="sysid1" protocol_num="0" name="Any" comment="Any IP Service" ro="False"/>
@@ -51,9 +51,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -69,9 +69,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -100,16 +100,16 @@
     </ObjectGroup>
     <ServiceGroup id="stdid05" name="Services" comment="" ro="False">
       <CustomService id="stdid14_1" name="ESTABLISHED" comment="This service matches all packets which are part of network connections established through the firewall, or connections 'related' to those established through the firewall. Term 'established' refers to the state tracking mechanism which exists inside iptables and other stateful firewalls and does not mean any particular combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful inspection module made appropriate record in the state table. Usually stateful firewalls keep track of network connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' describes packet belonging to a separate network connection, related to the session firewall is keeping track of. One example is FTP command and FTP data sessions." ro="False" protocol="any" address_family="ipv4">
-        <CustomServiceCommand platform="Undefined"/>
+        <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
         <CustomServiceCommand platform="iosacl">established</CustomServiceCommand>
-        <CustomServiceCommand platform="ipfilter"/>
+        <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
         <CustomServiceCommand platform="ipfw">established</CustomServiceCommand>
         <CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
       </CustomService>
       <CustomService id="stdid14_2" name="ESTABLISHED ipv6" comment="This service matches all packets which are part of network connections established through the firewall, or connections 'related' to those established through the firewall. Term 'established' refers to the state tracking mechanism which exists inside iptables and other stateful firewalls and does not mean any particular combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful inspection module made appropriate record in the state table. Usually stateful firewalls keep track of network connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' describes packet belonging to a separate network connection, related to the session firewall is keeping track of. One example is FTP command and FTP data sessions." ro="False" protocol="any" address_family="ipv6">
-        <CustomServiceCommand platform="Undefined"/>
+        <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
         <CustomServiceCommand platform="iosacl">established</CustomServiceCommand>
-        <CustomServiceCommand platform="ipfilter"/>
+        <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
         <CustomServiceCommand platform="ipfw">established</CustomServiceCommand>
         <CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
       </CustomService>
@@ -350,54 +350,54 @@
       </ServiceGroup>
       <ServiceGroup id="stdid13" name="Custom" comment="" ro="False">
         <CustomService id="id3B64EEA8" name="rpc" comment="works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"/>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfilter"/>
-          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m record_rpc</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
         <CustomService id="id3B64EF4E" name="irc-conn" comment="IRC connection tracker, supports DCC.&#10;Works on iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/&#10;" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"/>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfilter"/>
-          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m irc</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
         <CustomService id="id3B64EF50" name="psd" comment="Port scan detector, works only on iptables and  requires patch-o-matic &#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"/>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfilter"/>
-          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m psd --psd-weight-threshold 5 --psd-delay-threshold 10000</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
         <CustomService id="id3B64EF52" name="string" comment="Matches a string in a whole packet, works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"/>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfilter"/>
-          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m string --string test_pattern</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
         <CustomService id="id3B64EF54" name="talk" comment="Talk protocol support. Works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"/>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfilter"/>
-          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m talk</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
       </ServiceGroup>
       <ServiceGroup id="stdid19" name="TagServices" comment="" ro="False"/>
@@ -422,23 +422,23 @@
       </InterfaceOptions>
     </Interface>
     <Policy id="id6188X76214" name="to_fw" comment="" ro="False" ipv4_rule_set="True" ipv6_rule_set="False" top_rule_set="False">
-      <PolicyRule id="id10428X76214" disabled="False" log="True" position="0" action="Deny" direction="Both" comment="hashlimit 10/sec">
-            <Src neg="False">
+      <PolicyRule id="id10428X76214" disabled="False" group="" log="True" position="0" action="Deny" direction="Both" comment="hashlimit 10/sec">
+        <Src neg="False">
           <ObjectRef ref="sysid0"/>
         </Src>
-            <Dst neg="False">
+        <Dst neg="False">
           <ObjectRef ref="sysid0"/>
         </Dst>
-            <Srv neg="False">
+        <Srv neg="False">
           <ServiceRef ref="sysid1"/>
         </Srv>
-            <Itf neg="False">
+        <Itf neg="False">
           <ObjectRef ref="sysid0"/>
         </Itf>
-            <When neg="False">
+        <When neg="False">
           <IntervalRef ref="sysid2"/>
         </When>
-            <PolicyRuleOptions>
+        <PolicyRuleOptions>
           <Option name="connlimit_masklen">0</Option>
           <Option name="connlimit_value">0</Option>
           <Option name="firewall_is_part_of_any_and_networks">False</Option>
@@ -451,42 +451,40 @@
           <Option name="hashlimit_mode_dstport">False</Option>
           <Option name="hashlimit_mode_srcip">False</Option>
           <Option name="hashlimit_mode_srcport">False</Option>
-          <Option name="hashlimit_name"/>
+          <Option name="hashlimit_name"></Option>
           <Option name="hashlimit_size">0</Option>
           <Option name="hashlimit_suffix">/second</Option>
           <Option name="hashlimit_value">10</Option>
           <Option name="limit_burst">0</Option>
-          <Option name="limit_suffix"/>
+          <Option name="limit_suffix"></Option>
           <Option name="limit_value">0</Option>
-          <Option name="log_level"/>
-          <Option name="log_prefix"/>
+          <Option name="log_level"></Option>
+          <Option name="log_prefix"></Option>
+          <Option name="pf_classify_str"></Option>
           <Option name="stateless">True</Option>
           <Option name="ulog_nlgroup">1</Option>
-        
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
-          </PolicyRule>
+        </PolicyRuleOptions>
+      </PolicyRule>
       <RuleSetOptions/>
     </Policy>
     <Policy id="id2274X68642" name="to_fw" comment="" ro="False" ipv4_rule_set="True" ipv6_rule_set="False" top_rule_set="False">
-      <PolicyRule id="id2275X68642" disabled="False" log="True" position="0" action="Deny" direction="Both" comment="hashlimit 10/sec">
-            <Src neg="False">
+      <PolicyRule id="id2275X68642" disabled="False" group="" log="True" position="0" action="Deny" direction="Both" comment="hashlimit 10/sec">
+        <Src neg="False">
           <ObjectRef ref="sysid0"/>
         </Src>
-            <Dst neg="False">
+        <Dst neg="False">
           <ObjectRef ref="sysid0"/>
         </Dst>
-            <Srv neg="False">
+        <Srv neg="False">
           <ServiceRef ref="sysid1"/>
         </Srv>
-            <Itf neg="False">
+        <Itf neg="False">
           <ObjectRef ref="sysid0"/>
         </Itf>
-            <When neg="False">
+        <When neg="False">
           <IntervalRef ref="sysid2"/>
         </When>
-            <PolicyRuleOptions>
+        <PolicyRuleOptions>
           <Option name="connlimit_masklen">0</Option>
           <Option name="connlimit_value">0</Option>
           <Option name="firewall_is_part_of_any_and_networks">False</Option>
@@ -499,22 +497,20 @@
           <Option name="hashlimit_mode_dstport">False</Option>
           <Option name="hashlimit_mode_srcip">False</Option>
           <Option name="hashlimit_mode_srcport">False</Option>
-          <Option name="hashlimit_name"/>
+          <Option name="hashlimit_name"></Option>
           <Option name="hashlimit_size">0</Option>
           <Option name="hashlimit_suffix">/second</Option>
           <Option name="hashlimit_value">10</Option>
           <Option name="limit_burst">0</Option>
-          <Option name="limit_suffix"/>
+          <Option name="limit_suffix"></Option>
           <Option name="limit_value">0</Option>
-          <Option name="log_level"/>
-          <Option name="log_prefix"/>
+          <Option name="log_level"></Option>
+          <Option name="log_prefix"></Option>
+          <Option name="pf_classify_str"></Option>
           <Option name="stateless">True</Option>
           <Option name="ulog_nlgroup">1</Option>
-        
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
-          </PolicyRule>
+        </PolicyRuleOptions>
+      </PolicyRule>
       <RuleSetOptions/>
     </Policy>
     <Interface id="id2875X71781" dedicated_failover="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="Interface" comment="" ro="False">
@@ -581,16 +577,16 @@
       <FirewallOptions>
         <Option name="accept_established">True</Option>
         <Option name="accept_new_tcp_with_no_syn">True</Option>
-        <Option name="action_on_reject"/>
-        <Option name="activationCmd"/>
-        <Option name="admUser"/>
-        <Option name="altAddress"/>
+        <Option name="action_on_reject"></Option>
+        <Option name="activationCmd"></Option>
+        <Option name="admUser"></Option>
+        <Option name="altAddress"></Option>
         <Option name="bridging_fw">False</Option>
         <Option name="check_shading">False</Option>
         <Option name="clamp_mss_to_mtu">False</Option>
         <Option name="classify_mark_terminating">False</Option>
-        <Option name="cmdline"/>
-        <Option name="compiler"/>
+        <Option name="cmdline"></Option>
+        <Option name="compiler"></Option>
         <Option name="configure_interfaces">True</Option>
         <Option name="configure_vlan_interfaces">True</Option>
         <Option name="ctiqbe_fixup">2 2748 0 nil 0</Option>
@@ -598,7 +594,7 @@
         <Option name="dns_fixup">2 65535 0 nil 0</Option>
         <Option name="drop_invalid">False</Option>
         <Option name="eliminate_duplicates">true</Option>
-        <Option name="epilog_script"/>
+        <Option name="epilog_script"></Option>
         <Option name="espike_fixup">2 0 0 nil 0</Option>
         <Option name="firewall_dir">/etc</Option>
         <Option name="firewall_is_part_of_any_and_networks">True</Option>
@@ -611,9 +607,9 @@
         <Option name="icmp_error_fixup">2 0 0 nil 0</Option>
         <Option name="ignore_empty_groups">False</Option>
         <Option name="ils_fixup">2 389 389 nil 0</Option>
-        <Option name="ipt_mangle_only_rulesets"/>
+        <Option name="ipt_mangle_only_rulesets"></Option>
         <Option name="ipv4_6_order">ipv4_first</Option>
-        <Option name="limit_suffix"/>
+        <Option name="limit_suffix"></Option>
         <Option name="limit_value">0</Option>
         <Option name="linux24_ip_forward">1</Option>
         <Option name="load_modules">True</Option>
@@ -629,11 +625,11 @@
         <Option name="macosx_ip_forward">1</Option>
         <Option name="manage_virtual_addr">True</Option>
         <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-        <Option name="mgmt_addr"/>
+        <Option name="mgmt_addr"></Option>
         <Option name="mgmt_ssh">False</Option>
         <Option name="modules_dir">/lib/modules/`uname -r`/kernel/net/</Option>
         <Option name="openbsd_ip_forward">1</Option>
-        <Option name="output_file"/>
+        <Option name="output_file"></Option>
         <Option name="pf_limit_frags">5000</Option>
         <Option name="pf_limit_states">10000</Option>
         <Option name="pf_timeout_frag">30</Option>
@@ -649,31 +645,31 @@
         <Option name="pix_floodguard">true</Option>
         <Option name="pix_include_comments">true</Option>
         <Option name="pix_ip_address">True</Option>
-        <Option name="pix_ntp1"/>
+        <Option name="pix_ntp1"></Option>
         <Option name="pix_ntp1_pref">False</Option>
-        <Option name="pix_ntp2"/>
+        <Option name="pix_ntp2"></Option>
         <Option name="pix_ntp2_pref">False</Option>
-        <Option name="pix_ntp3"/>
+        <Option name="pix_ntp3"></Option>
         <Option name="pix_ntp3_pref">False</Option>
         <Option name="pix_route_dnat_supported">true</Option>
         <Option name="pix_rule_syslog_settings">false</Option>
         <Option name="pix_security_fragguard_supported">true</Option>
         <Option name="pix_set_communities_from_object_data">False</Option>
         <Option name="pix_set_host_name">True</Option>
-        <Option name="pix_snmp_poll_traps_1"/>
-        <Option name="pix_snmp_poll_traps_2"/>
-        <Option name="pix_snmp_server1"/>
-        <Option name="pix_snmp_server2"/>
+        <Option name="pix_snmp_poll_traps_1"></Option>
+        <Option name="pix_snmp_poll_traps_2"></Option>
+        <Option name="pix_snmp_server1"></Option>
+        <Option name="pix_snmp_server2"></Option>
         <Option name="pix_syslog_device_id_supported">false</Option>
         <Option name="pix_tcpmss">False</Option>
         <Option name="pix_tcpmss_value">0</Option>
         <Option name="pix_use_acl_remarks">true</Option>
         <Option name="pptp_fixup">2 1723 0 nil 0</Option>
         <Option name="prolog_place">top</Option>
-        <Option name="prolog_script"/>
+        <Option name="prolog_script"></Option>
         <Option name="rsh_fixup">2 514 0 nil 0</Option>
         <Option name="rtsp_fixup">2 554 0 nil 0</Option>
-        <Option name="scpArgs"/>
+        <Option name="scpArgs"></Option>
         <Option name="secuwall_add_files">False</Option>
         <Option name="secuwall_add_files_dir">/opt/secuwall/templates/default</Option>
         <Option name="secuwall_dns_reso1">files</Option>
@@ -683,7 +679,7 @@
         <Option name="smtp_fixup">2 25 25 nil 0</Option>
         <Option name="solaris_ip_forward">1</Option>
         <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-        <Option name="sshArgs"/>
+        <Option name="sshArgs"></Option>
         <Option name="tftp_fixup">2 69 0 nil 0</Option>
         <Option name="ulog_cprange">0</Option>
         <Option name="ulog_nlgroup">1</Option>
@@ -702,7 +698,7 @@
     <ObjectGroup id="id1502X69605" name="Clusters" comment="" ro="False">
       <Cluster id="id2366X75741" host_OS="pix_os" inactive="False" lastCompiled="1261535722" lastInstalled="0" lastModified="1269894674" platform="pix" name="cluster1" comment="" ro="False">
         <NAT id="id2370X75741" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id4606X78273" disabled="False" position="0" action="Translate" comment="">
+          <NATRule id="id4606X78273" disabled="False" group="" position="0" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="id2385X39486"/>
             </OSrc>
@@ -721,15 +717,18 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
         </NAT>
         <Policy id="id2369X75741" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id2913X78273" disabled="False" log="True" position="0" action="Deny" direction="Inbound" comment="anti spoofing rule">
+          <PolicyRule id="id2913X78273" disabled="False" group="" log="True" position="0" action="Deny" direction="Inbound" comment="anti spoofing rule">
             <Src neg="False">
               <ObjectRef ref="id2366X75741"/>
               <ObjectRef ref="id2385X39486"/>
@@ -747,11 +746,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id2879X78273" disabled="False" log="False" position="1" action="Accept" direction="Both" comment="SSH Access to firewall is permitted&#10;only from internal network">
+          <PolicyRule id="id2879X78273" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="SSH Access to firewall is permitted&#10;only from internal network">
             <Src neg="False">
               <ObjectRef ref="id2385X39486"/>
             </Src>
@@ -768,9 +766,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id17725X59293" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -789,11 +786,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id55439X897" disabled="False" group="" log="True" position="3" action="Accept" direction="Both" comment="Firewall uses one of the machines&#10;on internal network for DNS">
             <Src neg="False">
@@ -812,11 +807,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id2862X78273" disabled="False" log="True" position="4" action="Accept" direction="Both" comment="Firewall uses one of the machines&#10;on internal network for DNS">
+          <PolicyRule id="id2862X78273" disabled="False" group="" log="True" position="4" action="Accept" direction="Both" comment="Firewall uses one of the machines&#10;on internal network for DNS">
             <Src neg="False">
               <ObjectRef ref="id2366X75741"/>
             </Src>
@@ -833,9 +827,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3401X82678" disabled="False" group="test for interface groups" log="False" position="5" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -856,11 +849,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id20340X82678" disabled="False" group="test for interface groups" log="False" position="6" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -880,11 +871,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id89499X82678" disabled="False" group="test for interface groups" log="False" position="7" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -905,11 +894,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id89452X82678" disabled="False" group="test for interface groups" log="False" position="8" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -929,13 +916,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id2845X78273" disabled="False" log="True" position="9" action="Deny" direction="Both" comment="All other attempts to connect to&#10;the firewall are denied and logged">
+          <PolicyRule id="id2845X78273" disabled="False" group="" log="True" position="9" action="Deny" direction="Both" comment="All other attempts to connect to&#10;the firewall are denied and logged">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -952,11 +937,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id2828X78273" disabled="False" log="False" position="10" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id2828X78273" disabled="False" group="" log="False" position="10" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id2385X39486"/>
             </Src>
@@ -973,11 +957,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id2811X78273" disabled="False" log="True" position="11" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id2811X78273" disabled="False" group="" log="True" position="11" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -994,9 +977,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -1055,7 +1037,7 @@
       </Cluster>
       <Cluster id="id2851X26048" host_OS="pix_os" inactive="False" lastCompiled="1258127973" lastInstalled="0" lastModified="1258405852" platform="pix" name="cluster1_v6" comment="" ro="False">
         <NAT id="id2966X26048" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id2967X26048" disabled="False" position="0" action="Translate" comment="">
+          <NATRule id="id2967X26048" disabled="False" group="" position="0" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="id2385X39486"/>
             </OSrc>
@@ -1074,15 +1056,18 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
         </NAT>
         <Policy id="id2892X26048" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id2893X26048" disabled="False" log="True" position="0" action="Deny" direction="Inbound" comment="anti spoofing rule">
+          <PolicyRule id="id2893X26048" disabled="False" group="" log="True" position="0" action="Deny" direction="Inbound" comment="anti spoofing rule">
             <Src neg="False">
               <ObjectRef ref="id2851X26048"/>
               <ObjectRef ref="id2385X39486"/>
@@ -1100,11 +1085,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id2906X26048" disabled="False" log="False" position="1" action="Accept" direction="Both" comment="SSH Access to firewall is permitted&#10;only from internal network">
+          <PolicyRule id="id2906X26048" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="SSH Access to firewall is permitted&#10;only from internal network">
             <Src neg="False">
               <ObjectRef ref="id2385X39486"/>
             </Src>
@@ -1121,11 +1105,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id2918X26048" disabled="False" log="True" position="2" action="Accept" direction="Both" comment="Firewall uses one of the machines&#10;on internal network for DNS">
+          <PolicyRule id="id2918X26048" disabled="False" group="" log="True" position="2" action="Accept" direction="Both" comment="Firewall uses one of the machines&#10;on internal network for DNS">
             <Src neg="False">
               <ObjectRef ref="id2851X26048"/>
             </Src>
@@ -1142,11 +1125,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id2930X26048" disabled="False" log="True" position="3" action="Deny" direction="Both" comment="All other attempts to connect to&#10;the firewall are denied and logged">
+          <PolicyRule id="id2930X26048" disabled="False" group="" log="True" position="3" action="Deny" direction="Both" comment="All other attempts to connect to&#10;the firewall are denied and logged">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1163,11 +1145,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id2942X26048" disabled="False" log="False" position="4" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id2942X26048" disabled="False" group="" log="False" position="4" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id2385X39486"/>
             </Src>
@@ -1184,11 +1165,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id2954X26048" disabled="False" log="True" position="5" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id2954X26048" disabled="False" group="" log="True" position="5" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1205,9 +1185,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -1264,7 +1243,7 @@
       </Cluster>
       <Cluster id="id56535X61097" host_OS="pix_os" inactive="False" lastCompiled="1261535722" lastInstalled="0" lastModified="1269894987" platform="pix" name="cluster1-1" comment="the same as cluster1, but some failover groups are unconfigured or broken in some way" ro="False">
         <NAT id="id56688X61097" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <NATRule id="id56689X61097" disabled="False" position="0" action="Translate" comment="">
+          <NATRule id="id56689X61097" disabled="False" group="" position="0" action="Translate" comment="">
             <OSrc neg="False">
               <ObjectRef ref="id2385X39486"/>
             </OSrc>
@@ -1283,15 +1262,18 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
-            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
-            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
-            
+            <ItfInb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfInb>
+            <ItfOutb neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ItfOutb>
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
         </NAT>
         <Policy id="id56589X61097" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id56590X61097" disabled="False" log="True" position="0" action="Deny" direction="Inbound" comment="anti spoofing rule">
+          <PolicyRule id="id56590X61097" disabled="False" group="" log="True" position="0" action="Deny" direction="Inbound" comment="anti spoofing rule">
             <Src neg="False">
               <ObjectRef ref="id56535X61097"/>
               <ObjectRef ref="id2385X39486"/>
@@ -1309,11 +1291,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id56603X61097" disabled="False" log="False" position="1" action="Accept" direction="Both" comment="SSH Access to firewall is permitted&#10;only from internal network">
+          <PolicyRule id="id56603X61097" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="SSH Access to firewall is permitted&#10;only from internal network">
             <Src neg="False">
               <ObjectRef ref="id2385X39486"/>
             </Src>
@@ -1330,9 +1311,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id56615X61097" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -1351,11 +1331,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id56627X61097" disabled="False" group="" log="True" position="3" action="Accept" direction="Both" comment="Firewall uses one of the machines&#10;on internal network for DNS">
             <Src neg="False">
@@ -1374,11 +1352,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id56639X61097" disabled="False" log="True" position="4" action="Accept" direction="Both" comment="Firewall uses one of the machines&#10;on internal network for DNS">
+          <PolicyRule id="id56639X61097" disabled="False" group="" log="True" position="4" action="Accept" direction="Both" comment="Firewall uses one of the machines&#10;on internal network for DNS">
             <Src neg="False">
               <ObjectRef ref="id56535X61097"/>
             </Src>
@@ -1395,11 +1372,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id56651X61097" disabled="False" log="True" position="5" action="Deny" direction="Both" comment="All other attempts to connect to&#10;the firewall are denied and logged">
+          <PolicyRule id="id56651X61097" disabled="False" group="" log="True" position="5" action="Deny" direction="Both" comment="All other attempts to connect to&#10;the firewall are denied and logged">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1416,11 +1392,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id56663X61097" disabled="False" log="False" position="6" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id56663X61097" disabled="False" group="" log="False" position="6" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id2385X39486"/>
             </Src>
@@ -1437,11 +1412,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id56675X61097" disabled="False" log="True" position="7" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id56675X61097" disabled="False" group="" log="True" position="7" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1458,9 +1432,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -1585,12 +1558,12 @@
           <Interface id="id3814X97641" dedicated_failover="False" dyn="False" label="outside" mgmt="False" network_zone="sysid0" security_level="0" unnum="False" unprotected="False" name="Ethernet0.101" comment="" ro="False">
             <IPv4 id="id3816X97641" name="pix1:Ethernet0:Ethernet0.101:ip" comment="" ro="False" address="192.0.2.253" netmask="255.255.255.0"/>
             <InterfaceOptions>
-              <Option name="bonding_policy"/>
-              <Option name="bondng_driver_options"/>
+              <Option name="bonding_policy"></Option>
+              <Option name="bondng_driver_options"></Option>
               <Option name="enable_stp">False</Option>
               <Option name="type">8021q</Option>
               <Option name="vlan_id">101</Option>
-              <Option name="xmit_hash_policy"/>
+              <Option name="xmit_hash_policy"></Option>
             </InterfaceOptions>
           </Interface>
           <Interface id="id3817X97641" dedicated_failover="False" dyn="False" label="" mgmt="False" network_zone="id11817X97641" security_level="20" unnum="False" unprotected="False" name="Ethernet0.102" comment="" ro="False">
@@ -1615,16 +1588,16 @@
         <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
-          <Option name="action_on_reject"/>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="action_on_reject"></Option>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="classify_mark_terminating">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="configure_vlan_interfaces">True</Option>
           <Option name="conn_hh">0</Option>
@@ -1635,7 +1608,7 @@
           <Option name="dns_fixup">2 65535 0 nil 0</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="eliminate_duplicates">true</Option>
-          <Option name="epilog_script"/>
+          <Option name="epilog_script"></Option>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
@@ -1654,9 +1627,9 @@
           <Option name="icmp_error_fixup">2 0 0 nil 0</Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">2 389 389 nil 0</Option>
-          <Option name="ipt_mangle_only_rulesets"/>
+          <Option name="ipt_mangle_only_rulesets"></Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
-          <Option name="limit_suffix"/>
+          <Option name="limit_suffix"></Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">1</Option>
           <Option name="load_modules">True</Option>
@@ -1672,11 +1645,11 @@
           <Option name="macosx_ip_forward">1</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modules_dir">/lib/modules/`uname -r`/kernel/net/</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
           <Option name="pf_timeout_frag">30</Option>
@@ -1684,7 +1657,7 @@
           <Option name="pix_acl_basic">True</Option>
           <Option name="pix_acl_no_clear">False</Option>
           <Option name="pix_acl_substitution">False</Option>
-          <Option name="pix_acl_temp_addr"/>
+          <Option name="pix_acl_temp_addr"></Option>
           <Option name="pix_add_clear_statements">true</Option>
           <Option name="pix_assume_fw_part_of_any">True</Option>
           <Option name="pix_check_duplicate_nat">False</Option>
@@ -1698,7 +1671,7 @@
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
           <Option name="pix_enable_snmp_traps">False</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_floodguard">True</Option>
           <Option name="pix_fragguard">False</Option>
           <Option name="pix_generate_out_acl">True</Option>
@@ -1713,14 +1686,14 @@
           <Option name="pix_max_conns">0</Option>
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
-          <Option name="pix_ntp1"/>
+          <Option name="pix_ntp1"></Option>
           <Option name="pix_ntp1_pref">False</Option>
-          <Option name="pix_ntp2"/>
+          <Option name="pix_ntp2"></Option>
           <Option name="pix_ntp2_pref">False</Option>
-          <Option name="pix_ntp3"/>
+          <Option name="pix_ntp3"></Option>
           <Option name="pix_ntp3_pref">False</Option>
           <Option name="pix_optimize_default_nat">False</Option>
-          <Option name="pix_prolog_script"/>
+          <Option name="pix_prolog_script"></Option>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">False</Option>
           <Option name="pix_resetinbound">False</Option>
@@ -1731,16 +1704,16 @@
           <Option name="pix_security_fragguard_supported">true</Option>
           <Option name="pix_set_communities_from_object_data">False</Option>
           <Option name="pix_set_host_name">True</Option>
-          <Option name="pix_snmp_poll_traps_1"/>
-          <Option name="pix_snmp_poll_traps_2"/>
-          <Option name="pix_snmp_server1"/>
-          <Option name="pix_snmp_server2"/>
+          <Option name="pix_snmp_poll_traps_1"></Option>
+          <Option name="pix_snmp_poll_traps_2"></Option>
+          <Option name="pix_snmp_server1"></Option>
+          <Option name="pix_snmp_server2"></Option>
           <Option name="pix_ssh_timeout">0</Option>
-          <Option name="pix_syslog_device_id_opt"/>
+          <Option name="pix_syslog_device_id_opt"></Option>
           <Option name="pix_syslog_device_id_supported">false</Option>
-          <Option name="pix_syslog_device_id_val"/>
-          <Option name="pix_syslog_facility"/>
-          <Option name="pix_syslog_host"/>
+          <Option name="pix_syslog_device_id_val"></Option>
+          <Option name="pix_syslog_facility"></Option>
+          <Option name="pix_syslog_host"></Option>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_tcpmss">False</Option>
           <Option name="pix_tcpmss_value">0</Option>
@@ -1749,13 +1722,13 @@
           <Option name="pix_use_manual_commit">False</Option>
           <Option name="pptp_fixup">2 1723 0 nil 0</Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"/>
+          <Option name="prolog_script"></Option>
           <Option name="rpc_hh">0</Option>
           <Option name="rpc_mm">0</Option>
           <Option name="rpc_ss">0</Option>
           <Option name="rsh_fixup">2 514 0 nil 0</Option>
           <Option name="rtsp_fixup">2 554 0 nil 0</Option>
-          <Option name="scpArgs"/>
+          <Option name="scpArgs"></Option>
           <Option name="secuwall_add_files">False</Option>
           <Option name="secuwall_add_files_dir">/opt/secuwall/templates/default</Option>
           <Option name="secuwall_dns_reso1">files</Option>
@@ -1771,7 +1744,7 @@
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
           <Option name="solaris_ip_forward">1</Option>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
           <Option name="uauth_abs">False</Option>
           <Option name="uauth_hh">0</Option>
@@ -1818,12 +1791,12 @@
           <Interface id="id2818X95537" dedicated_failover="False" dyn="False" label="outside" mgmt="False" network_zone="sysid0" security_level="0" unnum="False" unprotected="False" name="Ethernet0.101" comment="" ro="False">
             <IPv4 id="id2826X97641" name="pix2:Ethernet0:Ethernet0.101:ip" comment="" ro="False" address="192.0.2.254" netmask="255.255.255.0"/>
             <InterfaceOptions>
-              <Option name="bonding_policy"/>
-              <Option name="bondng_driver_options"/>
+              <Option name="bonding_policy"></Option>
+              <Option name="bondng_driver_options"></Option>
               <Option name="enable_stp">False</Option>
               <Option name="type">8021q</Option>
               <Option name="vlan_id">101</Option>
-              <Option name="xmit_hash_policy"/>
+              <Option name="xmit_hash_policy"></Option>
             </InterfaceOptions>
           </Interface>
           <Interface id="id3315X97641" dedicated_failover="False" dyn="False" label="" mgmt="False" network_zone="id11817X97641" security_level="20" unnum="False" unprotected="False" name="Ethernet0.102" comment="" ro="False">
@@ -1848,16 +1821,16 @@
         <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
-          <Option name="action_on_reject"/>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="action_on_reject"></Option>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="classify_mark_terminating">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="configure_vlan_interfaces">True</Option>
           <Option name="conn_hh">0</Option>
@@ -1868,7 +1841,7 @@
           <Option name="dns_fixup">2 65535 0 nil 0</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="eliminate_duplicates">true</Option>
-          <Option name="epilog_script"/>
+          <Option name="epilog_script"></Option>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
@@ -1887,9 +1860,9 @@
           <Option name="icmp_error_fixup">2 0 0 nil 0</Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">2 389 389 nil 0</Option>
-          <Option name="ipt_mangle_only_rulesets"/>
+          <Option name="ipt_mangle_only_rulesets"></Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
-          <Option name="limit_suffix"/>
+          <Option name="limit_suffix"></Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">1</Option>
           <Option name="load_modules">True</Option>
@@ -1905,11 +1878,11 @@
           <Option name="macosx_ip_forward">1</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modules_dir">/lib/modules/`uname -r`/kernel/net/</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
           <Option name="pf_timeout_frag">30</Option>
@@ -1917,7 +1890,7 @@
           <Option name="pix_acl_basic">True</Option>
           <Option name="pix_acl_no_clear">False</Option>
           <Option name="pix_acl_substitution">False</Option>
-          <Option name="pix_acl_temp_addr"/>
+          <Option name="pix_acl_temp_addr"></Option>
           <Option name="pix_add_clear_statements">true</Option>
           <Option name="pix_assume_fw_part_of_any">True</Option>
           <Option name="pix_check_duplicate_nat">False</Option>
@@ -1931,7 +1904,7 @@
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
           <Option name="pix_enable_snmp_traps">False</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_floodguard">True</Option>
           <Option name="pix_fragguard">False</Option>
           <Option name="pix_generate_out_acl">True</Option>
@@ -1946,14 +1919,14 @@
           <Option name="pix_max_conns">0</Option>
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
-          <Option name="pix_ntp1"/>
+          <Option name="pix_ntp1"></Option>
           <Option name="pix_ntp1_pref">False</Option>
-          <Option name="pix_ntp2"/>
+          <Option name="pix_ntp2"></Option>
           <Option name="pix_ntp2_pref">False</Option>
-          <Option name="pix_ntp3"/>
+          <Option name="pix_ntp3"></Option>
           <Option name="pix_ntp3_pref">False</Option>
           <Option name="pix_optimize_default_nat">False</Option>
-          <Option name="pix_prolog_script"/>
+          <Option name="pix_prolog_script"></Option>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">False</Option>
           <Option name="pix_resetinbound">False</Option>
@@ -1964,16 +1937,16 @@
           <Option name="pix_security_fragguard_supported">true</Option>
           <Option name="pix_set_communities_from_object_data">False</Option>
           <Option name="pix_set_host_name">True</Option>
-          <Option name="pix_snmp_poll_traps_1"/>
-          <Option name="pix_snmp_poll_traps_2"/>
-          <Option name="pix_snmp_server1"/>
-          <Option name="pix_snmp_server2"/>
+          <Option name="pix_snmp_poll_traps_1"></Option>
+          <Option name="pix_snmp_poll_traps_2"></Option>
+          <Option name="pix_snmp_server1"></Option>
+          <Option name="pix_snmp_server2"></Option>
           <Option name="pix_ssh_timeout">0</Option>
-          <Option name="pix_syslog_device_id_opt"/>
+          <Option name="pix_syslog_device_id_opt"></Option>
           <Option name="pix_syslog_device_id_supported">false</Option>
-          <Option name="pix_syslog_device_id_val"/>
-          <Option name="pix_syslog_facility"/>
-          <Option name="pix_syslog_host"/>
+          <Option name="pix_syslog_device_id_val"></Option>
+          <Option name="pix_syslog_facility"></Option>
+          <Option name="pix_syslog_host"></Option>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_tcpmss">False</Option>
           <Option name="pix_tcpmss_value">0</Option>
@@ -1982,13 +1955,13 @@
           <Option name="pix_use_manual_commit">False</Option>
           <Option name="pptp_fixup">2 1723 0 nil 0</Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"/>
+          <Option name="prolog_script"></Option>
           <Option name="rpc_hh">0</Option>
           <Option name="rpc_mm">0</Option>
           <Option name="rpc_ss">0</Option>
           <Option name="rsh_fixup">2 514 0 nil 0</Option>
           <Option name="rtsp_fixup">2 554 0 nil 0</Option>
-          <Option name="scpArgs"/>
+          <Option name="scpArgs"></Option>
           <Option name="secuwall_add_files">False</Option>
           <Option name="secuwall_add_files_dir">/opt/secuwall/templates/default</Option>
           <Option name="secuwall_dns_reso1">files</Option>
@@ -2004,7 +1977,7 @@
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
           <Option name="solaris_ip_forward">1</Option>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
           <Option name="uauth_abs">False</Option>
           <Option name="uauth_hh">0</Option>
@@ -2064,16 +2037,16 @@
         <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
-          <Option name="action_on_reject"/>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="action_on_reject"></Option>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="classify_mark_terminating">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="configure_vlan_interfaces">True</Option>
           <Option name="ctiqbe_fixup">2 2748 0 nil 0</Option>
@@ -2081,7 +2054,7 @@
           <Option name="dns_fixup">2 65535 0 nil 0</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="eliminate_duplicates">true</Option>
-          <Option name="epilog_script"/>
+          <Option name="epilog_script"></Option>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
@@ -2094,9 +2067,9 @@
           <Option name="icmp_error_fixup">2 0 0 nil 0</Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">2 389 389 nil 0</Option>
-          <Option name="ipt_mangle_only_rulesets"/>
+          <Option name="ipt_mangle_only_rulesets"></Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
-          <Option name="limit_suffix"/>
+          <Option name="limit_suffix"></Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">1</Option>
           <Option name="load_modules">True</Option>
@@ -2112,11 +2085,11 @@
           <Option name="macosx_ip_forward">1</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modules_dir">/lib/modules/`uname -r`/kernel/net/</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
           <Option name="pf_timeout_frag">30</Option>
@@ -2132,31 +2105,31 @@
           <Option name="pix_floodguard">true</Option>
           <Option name="pix_include_comments">true</Option>
           <Option name="pix_ip_address">True</Option>
-          <Option name="pix_ntp1"/>
+          <Option name="pix_ntp1"></Option>
           <Option name="pix_ntp1_pref">False</Option>
-          <Option name="pix_ntp2"/>
+          <Option name="pix_ntp2"></Option>
           <Option name="pix_ntp2_pref">False</Option>
-          <Option name="pix_ntp3"/>
+          <Option name="pix_ntp3"></Option>
           <Option name="pix_ntp3_pref">False</Option>
           <Option name="pix_route_dnat_supported">true</Option>
           <Option name="pix_rule_syslog_settings">false</Option>
           <Option name="pix_security_fragguard_supported">true</Option>
           <Option name="pix_set_communities_from_object_data">False</Option>
           <Option name="pix_set_host_name">True</Option>
-          <Option name="pix_snmp_poll_traps_1"/>
-          <Option name="pix_snmp_poll_traps_2"/>
-          <Option name="pix_snmp_server1"/>
-          <Option name="pix_snmp_server2"/>
+          <Option name="pix_snmp_poll_traps_1"></Option>
+          <Option name="pix_snmp_poll_traps_2"></Option>
+          <Option name="pix_snmp_server1"></Option>
+          <Option name="pix_snmp_server2"></Option>
           <Option name="pix_syslog_device_id_supported">false</Option>
           <Option name="pix_tcpmss">False</Option>
           <Option name="pix_tcpmss_value">0</Option>
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="pptp_fixup">2 1723 0 nil 0</Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"/>
+          <Option name="prolog_script"></Option>
           <Option name="rsh_fixup">2 514 0 nil 0</Option>
           <Option name="rtsp_fixup">2 554 0 nil 0</Option>
-          <Option name="scpArgs"/>
+          <Option name="scpArgs"></Option>
           <Option name="secuwall_add_files">False</Option>
           <Option name="secuwall_add_files_dir">/opt/secuwall/templates/default</Option>
           <Option name="secuwall_dns_reso1">files</Option>
@@ -2166,7 +2139,7 @@
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
           <Option name="solaris_ip_forward">1</Option>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
@@ -2215,16 +2188,16 @@
         <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
-          <Option name="action_on_reject"/>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="action_on_reject"></Option>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="classify_mark_terminating">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="configure_vlan_interfaces">True</Option>
           <Option name="ctiqbe_fixup">2 2748 0 nil 0</Option>
@@ -2232,7 +2205,7 @@
           <Option name="dns_fixup">2 65535 0 nil 0</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="eliminate_duplicates">true</Option>
-          <Option name="epilog_script"/>
+          <Option name="epilog_script"></Option>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
@@ -2245,9 +2218,9 @@
           <Option name="icmp_error_fixup">2 0 0 nil 0</Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">2 389 389 nil 0</Option>
-          <Option name="ipt_mangle_only_rulesets"/>
+          <Option name="ipt_mangle_only_rulesets"></Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
-          <Option name="limit_suffix"/>
+          <Option name="limit_suffix"></Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">1</Option>
           <Option name="load_modules">True</Option>
@@ -2263,11 +2236,11 @@
           <Option name="macosx_ip_forward">1</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modules_dir">/lib/modules/`uname -r`/kernel/net/</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
           <Option name="pf_timeout_frag">30</Option>
@@ -2283,31 +2256,31 @@
           <Option name="pix_floodguard">true</Option>
           <Option name="pix_include_comments">true</Option>
           <Option name="pix_ip_address">True</Option>
-          <Option name="pix_ntp1"/>
+          <Option name="pix_ntp1"></Option>
           <Option name="pix_ntp1_pref">False</Option>
-          <Option name="pix_ntp2"/>
+          <Option name="pix_ntp2"></Option>
           <Option name="pix_ntp2_pref">False</Option>
-          <Option name="pix_ntp3"/>
+          <Option name="pix_ntp3"></Option>
           <Option name="pix_ntp3_pref">False</Option>
           <Option name="pix_route_dnat_supported">true</Option>
           <Option name="pix_rule_syslog_settings">false</Option>
           <Option name="pix_security_fragguard_supported">true</Option>
           <Option name="pix_set_communities_from_object_data">False</Option>
           <Option name="pix_set_host_name">True</Option>
-          <Option name="pix_snmp_poll_traps_1"/>
-          <Option name="pix_snmp_poll_traps_2"/>
-          <Option name="pix_snmp_server1"/>
-          <Option name="pix_snmp_server2"/>
+          <Option name="pix_snmp_poll_traps_1"></Option>
+          <Option name="pix_snmp_poll_traps_2"></Option>
+          <Option name="pix_snmp_server1"></Option>
+          <Option name="pix_snmp_server2"></Option>
           <Option name="pix_syslog_device_id_supported">false</Option>
           <Option name="pix_tcpmss">False</Option>
           <Option name="pix_tcpmss_value">0</Option>
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="pptp_fixup">2 1723 0 nil 0</Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"/>
+          <Option name="prolog_script"></Option>
           <Option name="rsh_fixup">2 514 0 nil 0</Option>
           <Option name="rtsp_fixup">2 554 0 nil 0</Option>
-          <Option name="scpArgs"/>
+          <Option name="scpArgs"></Option>
           <Option name="secuwall_add_files">False</Option>
           <Option name="secuwall_add_files_dir">/opt/secuwall/templates/default</Option>
           <Option name="secuwall_dns_reso1">files</Option>
@@ -2317,7 +2290,7 @@
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
           <Option name="solaris_ip_forward">1</Option>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
diff --git a/test/pix/objects-for-regression-tests.fwb b/test/pix/objects-for-regression-tests.fwb
index 215400284..406bd5ee9 100644
--- a/test/pix/objects-for-regression-tests.fwb
+++ b/test/pix/objects-for-regression-tests.fwb
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
-<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="20" lastModified="1302896751" id="root">
+<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="21" lastModified="1302896751" id="root">
   <Library id="syslib000" color="#d4f8ff" name="Standard" comment="Standard objects" ro="True">
     <AnyNetwork id="sysid0" name="Any" comment="Any Network" ro="False" address="0.0.0.0" netmask="0.0.0.0"/>
     <AnyIPService id="sysid1" protocol_num="0" name="Any" comment="Any IP Service" ro="False"/>
@@ -51,9 +51,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -69,9 +69,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -100,17 +100,17 @@
     </ObjectGroup>
     <ServiceGroup id="stdid05" name="Services" comment="" ro="False">
       <CustomService id="stdid14_1" name="ESTABLISHED" comment="This service matches all packets which are part of network connections established through the firewall, or connections 'related' to those established through the firewall. Term 'established' refers to the state tracking mechanism which exists inside iptables and other stateful firewalls and does not mean any particular combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful inspection module made appropriate record in the state table. Usually stateful firewalls keep track of network connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' describes packet belonging to a separate network connection, related to the session firewall is keeping track of. One example is FTP command and FTP data sessions." ro="False" protocol="any" address_family="ipv4">
-        <CustomServiceCommand platform="Undefined"/>
+        <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
         <CustomServiceCommand platform="iosacl">established</CustomServiceCommand>
-        <CustomServiceCommand platform="ipfilter"/>
+        <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
         <CustomServiceCommand platform="ipfw">established</CustomServiceCommand>
         <CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
         <CustomServiceCommand platform="procurve_acl">established</CustomServiceCommand>
       </CustomService>
       <CustomService id="stdid14_2" name="ESTABLISHED ipv6" comment="This service matches all packets which are part of network connections established through the firewall, or connections 'related' to those established through the firewall. Term 'established' refers to the state tracking mechanism which exists inside iptables and other stateful firewalls and does not mean any particular combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful inspection module made appropriate record in the state table. Usually stateful firewalls keep track of network connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' describes packet belonging to a separate network connection, related to the session firewall is keeping track of. One example is FTP command and FTP data sessions." ro="False" protocol="any" address_family="ipv6">
-        <CustomServiceCommand platform="Undefined"/>
+        <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
         <CustomServiceCommand platform="iosacl">established</CustomServiceCommand>
-        <CustomServiceCommand platform="ipfilter"/>
+        <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
         <CustomServiceCommand platform="ipfw">established</CustomServiceCommand>
         <CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
         <CustomServiceCommand platform="procurve_acl">established</CustomServiceCommand>
@@ -366,54 +366,54 @@
       </ServiceGroup>
       <ServiceGroup id="stdid13" name="Custom" comment="" ro="False">
         <CustomService id="id3B64EEA8" name="rpc" comment="works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"/>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfilter"/>
-          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m record_rpc</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
         <CustomService id="id3B64EF4E" name="irc-conn" comment="IRC connection tracker, supports DCC.&#10;Works on iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/&#10;" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"/>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfilter"/>
-          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m irc</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
         <CustomService id="id3B64EF50" name="psd" comment="Port scan detector, works only on iptables and  requires patch-o-matic &#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"/>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfilter"/>
-          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m psd --psd-weight-threshold 5 --psd-delay-threshold 10000</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
         <CustomService id="id3B64EF52" name="string" comment="Matches a string in a whole packet, works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"/>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfilter"/>
-          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m string --string test_pattern</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
         <CustomService id="id3B64EF54" name="talk" comment="Talk protocol support. Works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"/>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfilter"/>
-          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m talk</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
       </ServiceGroup>
       <ServiceGroup id="stdid19" name="TagServices" comment="" ro="False"/>
@@ -579,9 +579,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -648,9 +648,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -666,9 +666,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
@@ -683,9 +683,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -701,9 +701,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -719,9 +719,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -737,9 +737,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -755,9 +755,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -787,9 +787,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -805,9 +805,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -823,9 +823,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">False</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -841,9 +841,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">False</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -859,9 +859,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">False</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -877,9 +877,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">False</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -895,9 +895,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">False</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -909,9 +909,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -943,9 +943,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr_filter">True</Option>
           </HostOptions>
         </Host>
@@ -960,9 +960,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
@@ -977,9 +977,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
@@ -1008,9 +1008,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -1072,9 +1072,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -1090,9 +1090,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
@@ -1107,9 +1107,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
@@ -1124,9 +1124,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
@@ -1187,9 +1187,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -1206,9 +1206,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
@@ -1384,31 +1384,31 @@
       </ServiceGroup>
       <ServiceGroup id="stdid13_1" name="Custom" comment="" ro="False">
         <CustomService id="id3B64FE22" name="talk" comment="Talk support" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"/>
-          <CustomServiceCommand platform="ipfilter"/>
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m ip_conntrack_talk -m ip_nat_talk</CustomServiceCommand>
         </CustomService>
         <CustomService id="id21571X21575" name="custom serv 1" comment="" ro="False" protocol="tcp" address_family="ipv4">
-          <CustomServiceCommand platform="fwsm"/>
-          <CustomServiceCommand platform="iosacl"/>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfw"/>
-          <CustomServiceCommand platform="iptables"/>
-          <CustomServiceCommand platform="pf"/>
+          <CustomServiceCommand platform="fwsm"></CustomServiceCommand>
+          <CustomServiceCommand platform="iosacl"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
+          <CustomServiceCommand platform="iptables"></CustomServiceCommand>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
           <CustomServiceCommand platform="pix">tcp destination neq 8080</CustomServiceCommand>
-          <CustomServiceCommand platform="procurve_acl"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="procurve_acl"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
         <CustomService id="id80355X18586" name="custom serv 2" comment="" ro="False" protocol="tcp" address_family="ipv4">
-          <CustomServiceCommand platform="fwsm"/>
-          <CustomServiceCommand platform="iosacl"/>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfw"/>
-          <CustomServiceCommand platform="iptables"/>
-          <CustomServiceCommand platform="pf"/>
+          <CustomServiceCommand platform="fwsm"></CustomServiceCommand>
+          <CustomServiceCommand platform="iosacl"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
+          <CustomServiceCommand platform="iptables"></CustomServiceCommand>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
           <CustomServiceCommand platform="pix">neq 8080</CustomServiceCommand>
-          <CustomServiceCommand platform="procurve_acl"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="procurve_acl"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
       </ServiceGroup>
       <ServiceGroup id="stdid05_1_userservices" name="Users" comment="" ro="False"/>
@@ -1791,11 +1791,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="pol-firewall2-0" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="blocking short fragments">
             <Src neg="False">
@@ -1814,11 +1812,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3D6A8E85" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="комментарий по-русски">
             <Src neg="False">
@@ -1837,9 +1833,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="pol-firewall2-1" disabled="False" group="" log="True" position="3" action="Accept" direction="Outbound" comment="anti-spoofing rule">
             <Src neg="False">
@@ -1859,9 +1854,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3B92DFC5" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -1876,11 +1870,9 @@
             <Itf neg="False">
               <ObjectRef ref="if-FW-firewall2-eth0"/>
             </Itf>
-            
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3C4E4C38" disabled="False" group="" log="False" position="5" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -1896,11 +1888,9 @@
             <Itf neg="False">
               <ObjectRef ref="if-FW-firewall2-eth0"/>
             </Itf>
-            
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3D1168B6" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="">
             <Src neg="False">
@@ -1919,11 +1909,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3B58E39D" disabled="True" group="" log="True" position="7" action="Deny" direction="Both" comment="this rule, if enabled, shades&#10;some rule below because&#10;of service &quot;any ICMP&quot;">
             <Src neg="False">
@@ -1944,15 +1932,13 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"/>
-              <Option name="log_prefix"/>
+              <Option name="log_limit_suffix"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3D8FCE32" disabled="False" group="" log="False" position="8" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -1971,9 +1957,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="pol-firewall2-2" disabled="False" group="" log="False" position="9" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -1992,14 +1977,12 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3CE59C76" disabled="False" group="" log="True" position="10" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2019,15 +2002,13 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"/>
-              <Option name="log_prefix"/>
+              <Option name="log_limit_suffix"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3D6A8AB2" disabled="True" group="" log="False" position="11" action="Deny" direction="Both" comment="shades rule #8 below">
             <Src neg="False">
@@ -2046,11 +2027,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="pol-firewall2-3" disabled="False" group="" log="False" position="12" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2071,14 +2050,12 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3E155E82" disabled="False" group="" log="False" position="13" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2097,9 +2074,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3D0F8031" disabled="False" group="" log="False" position="14" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2118,9 +2094,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3D50CD96" disabled="False" group="" log="False" position="15" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2140,9 +2115,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3CD87B1E" disabled="False" group="" log="False" position="16" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2162,14 +2136,12 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3CD8770E" disabled="False" group="" log="False" position="17" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2189,14 +2161,12 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="pol-firewall2-4" disabled="False" group="" log="False" position="18" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2216,14 +2186,12 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id431BE7A0" disabled="False" group="" log="False" position="19" action="Accept" direction="Both" comment="objects hostA and hostB are&#10;redundant and should be removed by&#10; removeRedundantAddressesFromDst">
             <Src neg="False">
@@ -2245,14 +2213,12 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id431BD5EF" disabled="False" group="" log="False" position="20" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2271,9 +2237,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3CE597E3" disabled="True" group="" log="False" position="21" action="Accept" direction="Both" comment="rules 12 and 13 can be&#10;used to test shading">
             <Src neg="False">
@@ -2292,14 +2257,12 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3CE591F6" disabled="True" group="" log="False" position="22" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2318,14 +2281,12 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3B58E180" disabled="False" group="" log="True" position="23" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2344,9 +2305,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="pol-firewall2-5" disabled="False" group="" log="False" position="24" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2366,14 +2326,12 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="pol-firewall2-7" disabled="False" group="" log="True" position="25" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -2392,16 +2350,14 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"/>
-              <Option name="log_prefix"/>
+              <Option name="log_limit_suffix"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -2537,12 +2493,12 @@
           <Option name="accept_established">False</Option>
           <Option name="accept_new_tcp_with_no_syn">False</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">True</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="cmdline">-v</Option>
-          <Option name="compiler"/>
+          <Option name="compiler"></Option>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -2551,8 +2507,8 @@
           <Option name="dns_fixup">2 65535 0 nil 0</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
-          <Option name="filesystem"/>
-          <Option name="firewall_dir"/>
+          <Option name="filesystem"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ftp_fixup">0 21 0 strict 0</Option>
@@ -2569,9 +2525,9 @@
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">0 389 389 nil 0</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
           <Option name="limit_suffix">/second</Option>
           <Option name="limit_value">0</Option>
@@ -2584,7 +2540,7 @@
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
@@ -2598,7 +2554,7 @@
           <Option name="openbsd_ip_forward">1</Option>
           <Option name="openbsd_ip_redirect">0</Option>
           <Option name="openbsd_ip_sourceroute">0</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">False</Option>
           <Option name="pix_acl_basic">False</Option>
           <Option name="pix_acl_no_clear">False</Option>
@@ -2622,7 +2578,7 @@
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
           <Option name="pix_enable_snmp_traps">True</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_floodguard">False</Option>
           <Option name="pix_fragguard">True</Option>
           <Option name="pix_generate_out_acl">False</Option>
@@ -2644,9 +2600,9 @@
           <Option name="pix_nodnsalias_outbound">True</Option>
           <Option name="pix_ntp1">192.168.1.20</Option>
           <Option name="pix_ntp1_pref">True</Option>
-          <Option name="pix_ntp2"/>
+          <Option name="pix_ntp2"></Option>
           <Option name="pix_ntp2_pref">False</Option>
-          <Option name="pix_ntp3"/>
+          <Option name="pix_ntp3"></Option>
           <Option name="pix_ntp3_pref">False</Option>
           <Option name="pix_optimize_default_nat">True</Option>
           <Option name="pix_prolog_script">	
@@ -2715,8 +2671,8 @@
           <Option name="rpc_ss">0</Option>
           <Option name="rsh_fixup">0 514 0 nil 0</Option>
           <Option name="rtsp_fixup">0 554 0 nil 0</Option>
-          <Option name="scpArgs"/>
-          <Option name="script_env_path"/>
+          <Option name="scpArgs"></Option>
+          <Option name="script_env_path"></Option>
           <Option name="short_script">False</Option>
           <Option name="sip_fixup">0 5060 5060 nil 0</Option>
           <Option name="sip_hh">0</Option>
@@ -2728,11 +2684,11 @@
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">0 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">0 25 25 nil 0</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="sqlnet_fixup">0 1521 1521 nil 0</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
@@ -2936,13 +2892,10 @@
             <Itf neg="False">
               <ObjectRef ref="id3AF5AA96"/>
             </Itf>
-            
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3CD34BEF" disabled="True" group="" log="False" position="1" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -2961,11 +2914,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3AF5AAB4" disabled="False" group="" log="True" position="2" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
             <Src neg="False">
@@ -2981,13 +2932,10 @@
             <Itf neg="False">
               <ObjectRef ref="id3AF5AA99"/>
             </Itf>
-            
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id434C245721195" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -3006,9 +2954,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3D50B022" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -3029,9 +2976,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3D50B012" disabled="False" group="" log="False" position="5" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -3052,9 +2998,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id434C064921195" disabled="False" group="" log="False" position="6" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -3076,9 +3021,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3CCA26E4" disabled="True" group="" log="True" position="7" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -3097,11 +3041,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3B9AB902" disabled="True" group="" log="True" position="8" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -3120,11 +3062,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3F8FACF5" disabled="False" group="" log="False" position="9" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -3144,9 +3084,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3F8FADA8" disabled="True" group="" log="False" position="10" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -3168,9 +3107,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3AFC0F90" disabled="False" group="" log="True" position="11" action="Accept" direction="Both" comment="hostF has the same IP address as firewal.">
             <Src neg="False">
@@ -3189,9 +3127,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3B021E10" disabled="True" group="" log="True" position="12" action="Deny" direction="Both" comment="testing negation in the policy rule">
             <Src neg="True">
@@ -3211,15 +3148,13 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="limit_suffix">/minute</Option>
               <Option name="limit_value">10</Option>
-              <Option name="log_prefix"/>
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3B0B4A13" disabled="True" group="" log="True" position="13" action="Deny" direction="Both" comment="this rule is shaded by rule above.">
             <Src neg="True">
@@ -3239,11 +3174,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3B5535B7" disabled="True" group="" log="True" position="14" action="Deny" direction="Both" comment="this rule shades rule below">
             <Src neg="True">
@@ -3263,11 +3196,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3B11F63D" disabled="True" group="" log="True" position="15" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -3288,11 +3219,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3B021E6F" disabled="True" group="" log="True" position="16" action="Deny" direction="Both" comment="testing negation in service field">
             <Src neg="False">
@@ -3313,11 +3242,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3CCA2CF4" disabled="True" group="" log="True" position="17" action="Accept" direction="Both" comment="testing negation in service field">
             <Src neg="False">
@@ -3338,9 +3265,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3B45739A" disabled="True" group="" log="True" position="18" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -3359,11 +3285,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3AF5AAC8" disabled="False" group="" log="False" position="19" action="Accept" direction="Both" comment="'masquerading' rule">
             <Src neg="False">
@@ -3382,9 +3306,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3AF5AAE3" disabled="False" group="" log="True" position="20" action="Deny" direction="Both" comment="'catch all' rule">
             <Src neg="False">
@@ -3403,11 +3326,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -3436,17 +3357,17 @@
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="firewall_dir"/>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">0</Option>
@@ -3458,7 +3379,7 @@
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
@@ -3483,7 +3404,7 @@
           <Option name="pix_disable_snmp_agent">True</Option>
           <Option name="pix_emulate_out_acl">True</Option>
           <Option name="pix_enable_snmp_traps">False</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_fragguard">False</Option>
           <Option name="pix_h323_abs">True</Option>
           <Option name="pix_h323_hh">0</Option>
@@ -3494,14 +3415,14 @@
           <Option name="pix_ip_address">False</Option>
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
-          <Option name="pix_ntp1"/>
+          <Option name="pix_ntp1"></Option>
           <Option name="pix_ntp1_pref">True</Option>
-          <Option name="pix_ntp2"/>
+          <Option name="pix_ntp2"></Option>
           <Option name="pix_ntp2_pref">False</Option>
-          <Option name="pix_ntp3"/>
+          <Option name="pix_ntp3"></Option>
           <Option name="pix_ntp3_pref">False</Option>
           <Option name="pix_optimize_default_nat">False</Option>
-          <Option name="pix_prolog_script"/>
+          <Option name="pix_prolog_script"></Option>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">False</Option>
           <Option name="pix_rpc_abs">True</Option>
@@ -3524,12 +3445,12 @@
           <Option name="pix_sip_ss">0</Option>
           <Option name="pix_snmp_poll_traps_1">1</Option>
           <Option name="pix_snmp_poll_traps_2">1</Option>
-          <Option name="pix_snmp_server1"/>
-          <Option name="pix_snmp_server2"/>
+          <Option name="pix_snmp_server1"></Option>
+          <Option name="pix_snmp_server2"></Option>
           <Option name="pix_ssh_timeout">5</Option>
-          <Option name="pix_syslog_facility"/>
-          <Option name="pix_syslog_host"/>
-          <Option name="pix_syslog_level"/>
+          <Option name="pix_syslog_facility"></Option>
+          <Option name="pix_syslog_host"></Option>
+          <Option name="pix_syslog_level"></Option>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_tcpmss">False</Option>
           <Option name="pix_tcpmss_value">0</Option>
@@ -3556,10 +3477,10 @@
           <Option name="pix_xlate_ss">0</Option>
           <Option name="platform">iptables</Option>
           <Option name="proxy_arp">False</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="use_ip_tool">False</Option>
           <Option name="use_numeric_log_levels">False</Option>
         </FirewallOptions>
@@ -3944,11 +3865,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3DB0FA68" disabled="True" group="" log="True" position="1" action="Deny" direction="Inbound" comment="">
             <Src neg="False">
@@ -3963,13 +3882,10 @@
             <Itf neg="False">
               <ObjectRef ref="id3DB0FA5B"/>
             </Itf>
-            
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3DB0FA70" disabled="True" group="" log="False" position="2" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -3988,9 +3904,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3DB0FA7A" disabled="False" group="" log="True" position="3" action="Accept" direction="Outbound" comment="anti-spoofing rule">
             <Src neg="False">
@@ -4010,9 +3925,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3DB0FA88" disabled="True" group="" log="False" position="4" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -4027,11 +3941,9 @@
             <Itf neg="False">
               <ObjectRef ref="id3DB0FA85"/>
             </Itf>
-            
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3DB0FA90" disabled="False" group="" log="False" position="5" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4047,11 +3959,9 @@
             <Itf neg="False">
               <ObjectRef ref="id3DB0FA85"/>
             </Itf>
-            
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3DB0FA99" disabled="True" group="" log="False" position="6" action="Deny" direction="Inbound" comment="">
             <Src neg="False">
@@ -4070,11 +3980,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3DB0F9C7" disabled="False" group="" log="False" position="7" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4093,9 +4001,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3DB0F9BD" disabled="False" group="" log="False" position="8" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4114,14 +4021,12 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3DB0F9DB" disabled="False" group="" log="True" position="9" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4141,15 +4046,13 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"/>
-              <Option name="log_prefix"/>
+              <Option name="log_limit_suffix"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3DB0F9D1" disabled="True" group="" log="False" position="10" action="Deny" direction="Both" comment="shades rule #12">
             <Src neg="False">
@@ -4168,11 +4071,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3DB0F9E6" disabled="False" group="" log="False" position="11" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4193,14 +4094,12 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3DB10695" disabled="False" group="" log="False" position="12" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4219,9 +4118,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3DB0F9F2" disabled="False" group="" log="False" position="13" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4240,9 +4138,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3DB0F9FC" disabled="False" group="" log="False" position="14" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4262,14 +4159,12 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3DB0FA07" disabled="False" group="" log="False" position="15" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4289,14 +4184,12 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3DB0FA12" disabled="False" group="" log="False" position="16" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4316,14 +4209,12 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3DB0FA1D" disabled="True" group="" log="False" position="17" action="Accept" direction="Both" comment="rules 8 and 9 can be&#10;used to test shading">
             <Src neg="False">
@@ -4342,14 +4233,12 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3DB0FA27" disabled="True" group="" log="False" position="18" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4368,14 +4257,12 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3DB0FA31" disabled="False" group="" log="False" position="19" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4395,9 +4282,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3DB0FA3C" disabled="False" group="" log="True" position="20" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4416,9 +4302,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3DB0FA46" disabled="False" group="" log="False" position="21" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4438,14 +4323,12 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3DB0FA51" disabled="False" group="" log="True" position="22" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -4464,16 +4347,14 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"/>
-              <Option name="log_prefix"/>
+              <Option name="log_limit_suffix"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -4504,13 +4385,13 @@
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="cmdline">-v</Option>
-          <Option name="compiler"/>
+          <Option name="compiler"></Option>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="firewall_dir"/>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ftp_fixup">0 21 21 strict 0</Option>
@@ -4523,9 +4404,9 @@
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">0 389 389 nil 0</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/second</Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">0</Option>
@@ -4537,7 +4418,7 @@
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
@@ -4565,7 +4446,7 @@
           <Option name="pix_connection_timewait">True</Option>
           <Option name="pix_emulate_out_acl">True</Option>
           <Option name="pix_enable_snmp_traps">True</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_fragguard">True</Option>
           <Option name="pix_h323_abs">True</Option>
           <Option name="pix_h323_hh">0</Option>
@@ -4578,8 +4459,8 @@
           <Option name="pix_nodnsalias_inbound">True</Option>
           <Option name="pix_nodnsalias_outbound">True</Option>
           <Option name="pix_ntp1">192.168.1.20</Option>
-          <Option name="pix_ntp2"/>
-          <Option name="pix_ntp3"/>
+          <Option name="pix_ntp2"></Option>
+          <Option name="pix_ntp3"></Option>
           <Option name="pix_optimize_default_nat">False</Option>
           <Option name="pix_prolog_script">	
 </Option>
@@ -4644,7 +4525,7 @@
           <Option name="rpc_ss">0</Option>
           <Option name="rsh_fixup">0 514 514 nil 0</Option>
           <Option name="rtsp_fixup">0 554 554 nil 0</Option>
-          <Option name="script_env_path"/>
+          <Option name="script_env_path"></Option>
           <Option name="sip_fixup">0 5060 5060 nil 0</Option>
           <Option name="sip_hh">0</Option>
           <Option name="sip_media_hh">0</Option>
@@ -4654,9 +4535,9 @@
           <Option name="sip_ss">0</Option>
           <Option name="skinny_fixup">0 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">0 25 25 nil 0</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="sqlnet_fixup">0 1521 1521 nil 0</Option>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
@@ -4860,9 +4741,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3E9E32DA" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4881,9 +4761,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3E9E32E4" disabled="False" group="" log="False" position="2" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -4902,11 +4781,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3DF458C8" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4925,9 +4802,8 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3DF458D2" disabled="False" group="" log="False" position="4" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -4946,11 +4822,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -4976,11 +4850,11 @@
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
         <FirewallOptions>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">True</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -5005,7 +4879,7 @@
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">2 389 389 nil 0</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="pix_acl_no_clear">True</Option>
           <Option name="pix_add_clear_statements">False</Option>
@@ -5024,7 +4898,7 @@
           <Option name="pix_emb_limit">0</Option>
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_floodguard">True</Option>
           <Option name="pix_fragguard">True</Option>
           <Option name="pix_h323_abs">True</Option>
@@ -5074,8 +4948,8 @@ no sysopt nodnsalias outbound
           <Option name="pix_sip_mm">30</Option>
           <Option name="pix_sip_ss">0</Option>
           <Option name="pix_ssh_timeout">5</Option>
-          <Option name="pix_syslog_facility"/>
-          <Option name="pix_syslog_host"/>
+          <Option name="pix_syslog_facility"></Option>
+          <Option name="pix_syslog_host"></Option>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">5</Option>
           <Option name="pix_uauth_abs">True</Option>
@@ -5110,9 +4984,9 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">2 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
@@ -5206,9 +5080,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3F8F95B9" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -5227,9 +5100,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3F8F95C3" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -5248,9 +5120,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3F8F95CD" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="this comment&#10;consists of&#10;3 lines of text">
             <Src neg="False">
@@ -5272,9 +5143,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id616417X27607" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -5293,11 +5163,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id667575X27607" disabled="False" group="" log="False" position="5" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -5316,11 +5184,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3F8F95D7" disabled="False" group="" log="True" position="6" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -5342,11 +5208,9 @@ no sysopt nodnsalias outbound
               <Option name="disable_logging_for_this_rule">False</Option>
               <Option name="log_interval">120</Option>
               <Option name="log_level">notice</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -5371,8 +5235,8 @@ no sysopt nodnsalias outbound
         </Management>
         <FirewallOptions>
           <Option name="check_shading">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="conn_hh">0</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -5411,7 +5275,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emblem_log_format">True</Option>
           <Option name="pix_emulate_out_acl">True</Option>
           <Option name="pix_enable_snmp_traps">True</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_floodguard">False</Option>
           <Option name="pix_fragguard">True</Option>
           <Option name="pix_h323_abs">True</Option>
@@ -5422,18 +5286,18 @@ no sysopt nodnsalias outbound
           <Option name="pix_include_comments">True</Option>
           <Option name="pix_ip_address">True</Option>
           <Option name="pix_logging_buffered">False</Option>
-          <Option name="pix_logging_buffered_level"/>
+          <Option name="pix_logging_buffered_level"></Option>
           <Option name="pix_logging_console">False</Option>
-          <Option name="pix_logging_console_level"/>
+          <Option name="pix_logging_console_level"></Option>
           <Option name="pix_logging_timestamp">False</Option>
-          <Option name="pix_logging_trap_level"/>
+          <Option name="pix_logging_trap_level"></Option>
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
           <Option name="pix_ntp1">10.3.14.30</Option>
-          <Option name="pix_ntp2"/>
-          <Option name="pix_ntp3"/>
+          <Option name="pix_ntp2"></Option>
+          <Option name="pix_ntp3"></Option>
           <Option name="pix_optimize_default_nat">False</Option>
-          <Option name="pix_prolog_script"/>
+          <Option name="pix_prolog_script"></Option>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">False</Option>
           <Option name="pix_resetinbound">False</Option>
@@ -5460,7 +5324,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_snmp_poll_traps_1">1</Option>
           <Option name="pix_snmp_poll_traps_2">1</Option>
           <Option name="pix_snmp_server1">10.3.14.40</Option>
-          <Option name="pix_snmp_server2"/>
+          <Option name="pix_snmp_server2"></Option>
           <Option name="pix_ssh_timeout">5</Option>
           <Option name="pix_syslog_device_id_opt">string</Option>
           <Option name="pix_syslog_device_id_val">real_firewall</Option>
@@ -5503,10 +5367,10 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">2 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
-          <Option name="snmp_contact"/>
+          <Option name="snmp_contact"></Option>
           <Option name="snmp_description">Cisco PIX Firewall Version 6.2(2)
 </Option>
-          <Option name="snmp_location"/>
+          <Option name="snmp_location"></Option>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
           <Option name="uauth_abs">True</Option>
@@ -5763,9 +5627,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3FA349F8" disabled="False" group="" log="False" position="1" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -5784,11 +5647,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -5810,8 +5671,8 @@ no sysopt nodnsalias outbound
         </Management>
         <FirewallOptions>
           <Option name="check_shading">True</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -5837,7 +5698,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_conn_ss">0</Option>
           <Option name="pix_connection_timewait">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_floodguard">True</Option>
           <Option name="pix_fragguard">True</Option>
           <Option name="pix_h323_abs">True</Option>
@@ -5848,11 +5709,11 @@ no sysopt nodnsalias outbound
           <Option name="pix_include_comments">True</Option>
           <Option name="pix_ip_address">False</Option>
           <Option name="pix_logging_buffered">False</Option>
-          <Option name="pix_logging_buffered_level"/>
+          <Option name="pix_logging_buffered_level"></Option>
           <Option name="pix_logging_console">False</Option>
-          <Option name="pix_logging_console_level"/>
+          <Option name="pix_logging_console_level"></Option>
           <Option name="pix_logging_timestamp">False</Option>
-          <Option name="pix_logging_trap_level"/>
+          <Option name="pix_logging_trap_level"></Option>
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
           <Option name="pix_optimize_default_nat">True</Option>
@@ -5886,8 +5747,8 @@ no sysopt nodnsalias outbound
           <Option name="pix_sip_mm">30</Option>
           <Option name="pix_sip_ss">0</Option>
           <Option name="pix_ssh_timeout">5</Option>
-          <Option name="pix_syslog_facility"/>
-          <Option name="pix_syslog_host"/>
+          <Option name="pix_syslog_facility"></Option>
+          <Option name="pix_syslog_host"></Option>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">5</Option>
           <Option name="pix_uauth_abs">True</Option>
@@ -5915,9 +5776,9 @@ no sysopt nodnsalias outbound
           <Option name="sip_media_ss">0</Option>
           <Option name="sip_mm">30</Option>
           <Option name="sip_ss">0</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="uauth_abs">True</Option>
@@ -6036,9 +5897,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3FA74F18" disabled="False" group="" log="False" position="1" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -6057,11 +5917,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -6083,8 +5941,8 @@ no sysopt nodnsalias outbound
         </Management>
         <FirewallOptions>
           <Option name="check_shading">True</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -6110,7 +5968,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_conn_ss">0</Option>
           <Option name="pix_connection_timewait">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_floodguard">True</Option>
           <Option name="pix_fragguard">True</Option>
           <Option name="pix_h323_abs">True</Option>
@@ -6121,15 +5979,15 @@ no sysopt nodnsalias outbound
           <Option name="pix_include_comments">True</Option>
           <Option name="pix_ip_address">False</Option>
           <Option name="pix_logging_buffered">False</Option>
-          <Option name="pix_logging_buffered_level"/>
+          <Option name="pix_logging_buffered_level"></Option>
           <Option name="pix_logging_console">False</Option>
-          <Option name="pix_logging_console_level"/>
+          <Option name="pix_logging_console_level"></Option>
           <Option name="pix_logging_timestamp">False</Option>
-          <Option name="pix_logging_trap_level"/>
+          <Option name="pix_logging_trap_level"></Option>
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
           <Option name="pix_optimize_default_nat">True</Option>
-          <Option name="pix_prolog_script"/>
+          <Option name="pix_prolog_script"></Option>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">False</Option>
           <Option name="pix_resetinbound">False</Option>
@@ -6152,8 +6010,8 @@ no sysopt nodnsalias outbound
           <Option name="pix_sip_mm">30</Option>
           <Option name="pix_sip_ss">0</Option>
           <Option name="pix_ssh_timeout">5</Option>
-          <Option name="pix_syslog_facility"/>
-          <Option name="pix_syslog_host"/>
+          <Option name="pix_syslog_facility"></Option>
+          <Option name="pix_syslog_host"></Option>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">5</Option>
           <Option name="pix_uauth_abs">True</Option>
@@ -6181,9 +6039,9 @@ no sysopt nodnsalias outbound
           <Option name="sip_media_ss">0</Option>
           <Option name="sip_mm">30</Option>
           <Option name="sip_ss">0</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="uauth_abs">True</Option>
@@ -6281,7 +6139,7 @@ no sysopt nodnsalias outbound
               <ObjectRef ref="sysid0"/>
             </ItfOutb>
             <NATRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
           <NATRule id="id3D1BF5EB" disabled="False" group="" position="3" action="Translate" comment="">
@@ -6392,7 +6250,7 @@ no sysopt nodnsalias outbound
               <ObjectRef ref="sysid0"/>
             </ItfOutb>
             <NATRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
           <NATRule id="id3D1BF934" disabled="False" group="" position="7" action="Translate" comment="">
@@ -6421,7 +6279,7 @@ no sysopt nodnsalias outbound
               <ObjectRef ref="sysid0"/>
             </ItfOutb>
             <NATRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
           <NATRule id="id3AFB66D6" disabled="False" group="" position="8" action="Translate" comment="">
@@ -6450,7 +6308,7 @@ no sysopt nodnsalias outbound
               <ObjectRef ref="sysid0"/>
             </ItfOutb>
             <NATRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
           <NATRule id="id3D1BFB42" disabled="False" group="" position="9" action="Translate" comment="">
@@ -7094,17 +6952,14 @@ no sysopt nodnsalias outbound
             <Itf neg="False">
               <ObjectRef ref="id3AFB6706"/>
             </Itf>
-            
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
               <Option name="log_prefix">Iface: %I RULE %N -- %A **</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3AFB6710" disabled="False" group="" log="True" position="1" action="Deny" direction="Outbound" comment="Anti-spoofing rule">
             <Src neg="True">
@@ -7120,17 +6975,14 @@ no sysopt nodnsalias outbound
             <Itf neg="False">
               <ObjectRef ref="id3AFB6706"/>
             </Itf>
-            
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
               <Option name="log_prefix">Iface: %I RULE %N -- %A **</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3D6EF08C" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -7150,9 +7002,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3D8FCCDE" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -7172,9 +7023,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3D8FCCFF" disabled="False" group="" log="False" position="4" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -7194,9 +7044,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3D8ACF6A" disabled="True" group="" log="False" position="5" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -7215,11 +7064,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3D6EF082" disabled="False" group="" log="False" position="6" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -7238,11 +7085,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -7272,17 +7117,17 @@ no sysopt nodnsalias outbound
           <Option name="action_on_reject">ICMP net unreachable</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="cmdline">-v</Option>
-          <Option name="compiler"/>
+          <Option name="compiler"></Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="firewall_dir"/>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
-          <Option name="id"/>
+          <Option name="id"></Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/second</Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_accept_redirects">0</Option>
@@ -7321,7 +7166,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_conn_mm">0</Option>
           <Option name="pix_conn_ss">0</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_h323_abs">True</Option>
           <Option name="pix_h323_hh">0</Option>
           <Option name="pix_h323_inact">False</Option>
@@ -7329,7 +7174,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_h323_ss">0</Option>
           <Option name="pix_include_comments">True</Option>
           <Option name="pix_ip_address">False</Option>
-          <Option name="pix_prolog_script"/>
+          <Option name="pix_prolog_script"></Option>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">True</Option>
           <Option name="pix_rpc_abs">True</Option>
@@ -7367,10 +7212,10 @@ no sysopt nodnsalias outbound
           <Option name="pix_xlate_ss">0</Option>
           <Option name="platform">iptables</Option>
           <Option name="proxy_arp">True</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="use_ip_tool">True</Option>
           <Option name="use_numeric_log_levels">False</Option>
         </FirewallOptions>
@@ -7397,9 +7242,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3D6AD819" disabled="False" group="" log="False" position="1" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -7418,9 +7262,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3D6ADAC0" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -7439,9 +7282,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3D6ADB5D" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -7460,9 +7302,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3D6AD743" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -7481,9 +7322,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3D6AD7B8" disabled="False" group="" log="False" position="5" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -7502,9 +7342,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3D6AD8CF" disabled="False" group="" log="False" position="6" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -7523,9 +7362,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3D6AD8DA" disabled="False" group="" log="False" position="7" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -7544,9 +7382,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3D6A95A4" disabled="False" group="" log="False" position="8" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -7565,9 +7402,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3D6AD9E6" disabled="False" group="" log="False" position="9" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -7586,9 +7422,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3D6A9D32" disabled="False" group="" log="False" position="10" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -7607,9 +7442,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3D6AD615" disabled="False" group="" log="False" position="11" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -7628,9 +7462,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3D6AA594" disabled="False" group="" log="False" position="12" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -7649,9 +7482,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3D6AD622" disabled="False" group="" log="False" position="13" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -7670,9 +7502,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3D6AD62C" disabled="False" group="" log="False" position="14" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -7691,11 +7522,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -7724,24 +7553,24 @@ no sysopt nodnsalias outbound
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="firewall_dir"/>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="h323_hh">0</Option>
           <Option name="h323_mm">5</Option>
           <Option name="h323_ss">0</Option>
-          <Option name="id"/>
+          <Option name="id"></Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/second</Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_accept_redirects">0</Option>
@@ -7781,7 +7610,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_conn_ss">0</Option>
           <Option name="pix_connection_timewait">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_fragguard">False</Option>
           <Option name="pix_h323_abs">True</Option>
           <Option name="pix_h323_hh">0</Option>
@@ -7792,7 +7621,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_ip_address">False</Option>
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
-          <Option name="pix_prolog_script"/>
+          <Option name="pix_prolog_script"></Option>
           <Option name="pix_resetinbound">False</Option>
           <Option name="pix_resetoutside">False</Option>
           <Option name="pix_rpc_abs">True</Option>
@@ -7812,9 +7641,9 @@ no sysopt nodnsalias outbound
           <Option name="pix_sip_mm">30</Option>
           <Option name="pix_sip_ss">0</Option>
           <Option name="pix_ssh_timeout">5</Option>
-          <Option name="pix_syslog_facility"/>
-          <Option name="pix_syslog_host"/>
-          <Option name="pix_syslog_level"/>
+          <Option name="pix_syslog_facility"></Option>
+          <Option name="pix_syslog_host"></Option>
+          <Option name="pix_syslog_level"></Option>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">5</Option>
           <Option name="pix_udp_abs">True</Option>
@@ -7837,16 +7666,16 @@ no sysopt nodnsalias outbound
           <Option name="rpc_hh">0</Option>
           <Option name="rpc_mm">10</Option>
           <Option name="rpc_ss">0</Option>
-          <Option name="script_env_path"/>
+          <Option name="script_env_path"></Option>
           <Option name="sip_hh">0</Option>
           <Option name="sip_media_hh">0</Option>
           <Option name="sip_media_mm">0</Option>
           <Option name="sip_media_ss">0</Option>
           <Option name="sip_mm">30</Option>
           <Option name="sip_ss">0</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="uauth_abs">True</Option>
@@ -7967,11 +7796,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="id"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3D79A1C2" disabled="False" group="" log="True" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -7991,11 +7818,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="id"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3D79A1E4" disabled="False" group="" log="True" position="2" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -8015,11 +7840,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="id"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3B0C63CB" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="'masquerading' rule">
             <Src neg="False">
@@ -8038,11 +7861,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="id"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3B0C63D5" disabled="False" group="" log="True" position="4" action="Deny" direction="Both" comment="'catch all' rule">
             <Src neg="False">
@@ -8061,12 +7882,10 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -8099,24 +7918,24 @@ no sysopt nodnsalias outbound
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="firewall_dir"/>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="h323_hh">0</Option>
           <Option name="h323_mm">5</Option>
           <Option name="h323_ss">0</Option>
-          <Option name="id"/>
+          <Option name="id"></Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">0</Option>
@@ -8128,7 +7947,7 @@ no sysopt nodnsalias outbound
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
@@ -8144,36 +7963,36 @@ no sysopt nodnsalias outbound
           <Option name="pix_check_rule_shading">False</Option>
           <Option name="pix_connection_timewait">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_fragguard">False</Option>
           <Option name="pix_include_comments">True</Option>
           <Option name="pix_ip_address">False</Option>
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
-          <Option name="pix_prolog_script"/>
+          <Option name="pix_prolog_script"></Option>
           <Option name="pix_replace_natted_objects">True</Option>
           <Option name="pix_resetinbound">False</Option>
           <Option name="pix_resetoutside">False</Option>
           <Option name="pix_set_host_name">False</Option>
-          <Option name="pix_syslog_facility"/>
-          <Option name="pix_syslog_host"/>
-          <Option name="pix_syslog_level"/>
+          <Option name="pix_syslog_facility"></Option>
+          <Option name="pix_syslog_host"></Option>
+          <Option name="pix_syslog_level"></Option>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="platform">iptables</Option>
           <Option name="proxy_arp">False</Option>
           <Option name="rpc_hh">0</Option>
           <Option name="rpc_mm">10</Option>
           <Option name="rpc_ss">0</Option>
-          <Option name="script_env_path"/>
+          <Option name="script_env_path"></Option>
           <Option name="sip_hh">0</Option>
           <Option name="sip_media_hh">0</Option>
           <Option name="sip_media_mm">0</Option>
           <Option name="sip_media_ss">0</Option>
           <Option name="sip_mm">30</Option>
           <Option name="sip_ss">0</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="uauth_abs">True</Option>
@@ -8316,13 +8135,10 @@ no sysopt nodnsalias outbound
             <Itf neg="False">
               <ObjectRef ref="id3C69901D"/>
             </Itf>
-            
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3C698FB2" disabled="False" group="" log="False" position="1" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -8341,11 +8157,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -8374,23 +8188,23 @@ no sysopt nodnsalias outbound
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="firewall_dir"/>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="h323_hh">0</Option>
           <Option name="h323_mm">5</Option>
           <Option name="h323_ss">0</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">0</Option>
@@ -8402,7 +8216,7 @@ no sysopt nodnsalias outbound
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
@@ -8418,7 +8232,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_check_rule_shading">False</Option>
           <Option name="pix_connection_timewait">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_fragguard">False</Option>
           <Option name="pix_include_comments">True</Option>
           <Option name="pix_ip_address">False</Option>
@@ -8430,7 +8244,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_logging_trap_level">4</Option>
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
-          <Option name="pix_prolog_script"/>
+          <Option name="pix_prolog_script"></Option>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">True</Option>
           <Option name="pix_resetinbound">False</Option>
@@ -8446,16 +8260,16 @@ no sysopt nodnsalias outbound
           <Option name="rpc_hh">0</Option>
           <Option name="rpc_mm">10</Option>
           <Option name="rpc_ss">0</Option>
-          <Option name="script_env_path"/>
+          <Option name="script_env_path"></Option>
           <Option name="sip_hh">0</Option>
           <Option name="sip_media_hh">0</Option>
           <Option name="sip_media_mm">0</Option>
           <Option name="sip_media_ss">0</Option>
           <Option name="sip_mm">30</Option>
           <Option name="sip_ss">0</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="uauth_abs">True</Option>
@@ -8549,9 +8363,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3D91662E" disabled="False" group="" log="False" position="1" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -8570,9 +8383,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3DAD0EAE" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -8591,9 +8403,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3DAD0EA4" disabled="False" group="" log="False" position="3" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -8612,11 +8423,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -8641,23 +8450,23 @@ no sysopt nodnsalias outbound
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="firewall_dir"/>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="h323_hh">0</Option>
           <Option name="h323_mm">5</Option>
           <Option name="h323_ss">0</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">0</Option>
@@ -8669,7 +8478,7 @@ no sysopt nodnsalias outbound
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
@@ -8684,10 +8493,10 @@ no sysopt nodnsalias outbound
           <Option name="pix_check_overlapping_statics">True</Option>
           <Option name="pix_check_rule_shading">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_include_comments">True</Option>
           <Option name="pix_ip_address">False</Option>
-          <Option name="pix_prolog_script"/>
+          <Option name="pix_prolog_script"></Option>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">True</Option>
           <Option name="pix_set_host_name">False</Option>
@@ -8696,13 +8505,13 @@ no sysopt nodnsalias outbound
           <Option name="rpc_hh">0</Option>
           <Option name="rpc_mm">10</Option>
           <Option name="rpc_ss">0</Option>
-          <Option name="script_env_path"/>
+          <Option name="script_env_path"></Option>
           <Option name="sip_hh">0</Option>
           <Option name="sip_mm">30</Option>
           <Option name="sip_ss">0</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="uauth_abs">True</Option>
@@ -8932,9 +8741,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3DB10B57" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -8953,9 +8761,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3DB10B4C" disabled="False" group="" log="False" position="2" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -8974,11 +8781,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -9004,8 +8809,8 @@ no sysopt nodnsalias outbound
         </Management>
         <FirewallOptions>
           <Option name="check_shading">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -9046,7 +8851,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emb_limit">0</Option>
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_floodguard">True</Option>
           <Option name="pix_fragguard">True</Option>
           <Option name="pix_h323_abs">True</Option>
@@ -9057,11 +8862,11 @@ no sysopt nodnsalias outbound
           <Option name="pix_include_comments">True</Option>
           <Option name="pix_ip_address">False</Option>
           <Option name="pix_logging_buffered">False</Option>
-          <Option name="pix_logging_buffered_level"/>
+          <Option name="pix_logging_buffered_level"></Option>
           <Option name="pix_logging_console">False</Option>
-          <Option name="pix_logging_console_level"/>
+          <Option name="pix_logging_console_level"></Option>
           <Option name="pix_logging_timestamp">False</Option>
-          <Option name="pix_logging_trap_level"/>
+          <Option name="pix_logging_trap_level"></Option>
           <Option name="pix_max_conns">0</Option>
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
@@ -9096,8 +8901,8 @@ no sysopt nodnsalias outbound
           <Option name="pix_sip_mm">30</Option>
           <Option name="pix_sip_ss">0</Option>
           <Option name="pix_ssh_timeout">5</Option>
-          <Option name="pix_syslog_facility"/>
-          <Option name="pix_syslog_host"/>
+          <Option name="pix_syslog_facility"></Option>
+          <Option name="pix_syslog_host"></Option>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">5</Option>
           <Option name="pix_uauth_abs">True</Option>
@@ -9132,9 +8937,9 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">2 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
@@ -9181,8 +8986,8 @@ no sysopt nodnsalias outbound
         </Management>
         <FirewallOptions>
           <Option name="check_shading">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="conn_hh">0</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -9218,7 +9023,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_conn_ss">0</Option>
           <Option name="pix_connection_timewait">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_floodguard">False</Option>
           <Option name="pix_fragguard">False</Option>
           <Option name="pix_h323_abs">True</Option>
@@ -9229,11 +9034,11 @@ no sysopt nodnsalias outbound
           <Option name="pix_include_comments">True</Option>
           <Option name="pix_ip_address">False</Option>
           <Option name="pix_logging_buffered">False</Option>
-          <Option name="pix_logging_buffered_level"/>
+          <Option name="pix_logging_buffered_level"></Option>
           <Option name="pix_logging_console">False</Option>
-          <Option name="pix_logging_console_level"/>
+          <Option name="pix_logging_console_level"></Option>
           <Option name="pix_logging_timestamp">False</Option>
-          <Option name="pix_logging_trap_level"/>
+          <Option name="pix_logging_trap_level"></Option>
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
           <Option name="pix_optimize_default_nat">False</Option>
@@ -9267,8 +9072,8 @@ no sysopt nodnsalias outbound
           <Option name="pix_sip_mm">30</Option>
           <Option name="pix_sip_ss">0</Option>
           <Option name="pix_ssh_timeout">5</Option>
-          <Option name="pix_syslog_facility"/>
-          <Option name="pix_syslog_host"/>
+          <Option name="pix_syslog_facility"></Option>
+          <Option name="pix_syslog_host"></Option>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">5</Option>
           <Option name="pix_uauth_abs">True</Option>
@@ -9302,9 +9107,9 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">0 0 0 nil 0</Option>
           <Option name="skinny_fixup">0 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">0 25 25 nil 0</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="sqlnet_fixup">0 1521 1521 nil 0</Option>
           <Option name="tftp_fixup">0 69 0 nil 0</Option>
           <Option name="uauth_abs">True</Option>
@@ -9338,11 +9143,9 @@ no sysopt nodnsalias outbound
             <Itf neg="False">
               <ObjectRef ref="id3AF5A2CB"/>
             </Itf>
-            
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3AFB70C7" disabled="False" group="" log="False" position="1" action="Accept" direction="Inbound" comment="allow everything on loopback">
             <Src neg="False">
@@ -9357,11 +9160,9 @@ no sysopt nodnsalias outbound
             <Itf neg="False">
               <ObjectRef ref="id3AFB7090"/>
             </Itf>
-            
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3AFB70CF" disabled="False" group="" log="False" position="2" action="Accept" direction="Outbound" comment="allow everything on loopback">
             <Src neg="False">
@@ -9376,11 +9177,9 @@ no sysopt nodnsalias outbound
             <Itf neg="False">
               <ObjectRef ref="id3AFB7090"/>
             </Itf>
-            
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3BD8ECC6" disabled="True" group="" log="True" position="3" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -9395,11 +9194,9 @@ no sysopt nodnsalias outbound
             <Itf neg="False">
               <ObjectRef ref="id3AFB7090"/>
             </Itf>
-            
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3AF5A74B" disabled="False" group="" log="True" position="4" action="Deny" direction="Both" comment="block fragments">
             <Src neg="False">
@@ -9418,11 +9215,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3AF5A73A" disabled="False" group="" log="False" position="5" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -9446,9 +9241,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3AF5A757" disabled="False" group="" log="False" position="6" action="Accept" direction="Both" comment="allow all outgoing connections">
             <Src neg="False">
@@ -9467,9 +9261,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3AF5A762" disabled="False" group="" log="True" position="7" action="Deny" direction="Both" comment="'catch all' rule">
             <Src neg="False">
@@ -9488,11 +9281,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -9517,17 +9308,17 @@ no sysopt nodnsalias outbound
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP host prohibited</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="firewall_dir"/>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">0</Option>
@@ -9537,9 +9328,9 @@ no sysopt nodnsalias outbound
           <Option name="log_all_dropped">False</Option>
           <Option name="log_ip_opt">False</Option>
           <Option name="log_level">debug</Option>
-          <Option name="log_limit_suffix"/>
+          <Option name="log_limit_suffix"></Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">False</Option>
@@ -9548,10 +9339,10 @@ no sysopt nodnsalias outbound
           <Option name="no_optimisation">False</Option>
           <Option name="pass_all_out">False</Option>
           <Option name="platform">iptables</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="use_ip_tool">False</Option>
           <Option name="use_numeric_log_levels">False</Option>
         </FirewallOptions>
@@ -9632,9 +9423,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3F8F92B1" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -9653,9 +9443,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3D385F90" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -9674,9 +9463,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3F8F940C" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -9695,9 +9483,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3D385E0F" disabled="False" group="" log="True" position="4" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -9719,11 +9506,9 @@ no sysopt nodnsalias outbound
               <Option name="disable_logging_for_this_rule">False</Option>
               <Option name="log_interval">120</Option>
               <Option name="log_level">notice</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -9743,11 +9528,11 @@ no sysopt nodnsalias outbound
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
         <FirewallOptions>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="conn_hh">0</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -9769,13 +9554,13 @@ no sysopt nodnsalias outbound
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">2 389 389 nil 0</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pix_acl_basic">True</Option>
           <Option name="pix_acl_no_clear">False</Option>
           <Option name="pix_acl_substitution">False</Option>
-          <Option name="pix_acl_temp_addr"/>
+          <Option name="pix_acl_temp_addr"></Option>
           <Option name="pix_add_clear_statements">False</Option>
           <Option name="pix_assume_fw_part_of_any">False</Option>
           <Option name="pix_check_duplicate_nat">False</Option>
@@ -9794,7 +9579,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emblem_log_format">True</Option>
           <Option name="pix_emulate_out_acl">True</Option>
           <Option name="pix_enable_snmp_traps">True</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_floodguard">False</Option>
           <Option name="pix_fragguard">False</Option>
           <Option name="pix_h323_abs">True</Option>
@@ -9814,10 +9599,10 @@ no sysopt nodnsalias outbound
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
           <Option name="pix_ntp1">10.3.14.30</Option>
-          <Option name="pix_ntp2"/>
-          <Option name="pix_ntp3"/>
+          <Option name="pix_ntp2"></Option>
+          <Option name="pix_ntp3"></Option>
           <Option name="pix_optimize_default_nat">False</Option>
-          <Option name="pix_prolog_script"/>
+          <Option name="pix_prolog_script"></Option>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">True</Option>
           <Option name="pix_resetinbound">False</Option>
@@ -9844,7 +9629,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_snmp_poll_traps_1">1</Option>
           <Option name="pix_snmp_poll_traps_2">1</Option>
           <Option name="pix_snmp_server1">10.3.14.40</Option>
-          <Option name="pix_snmp_server2"/>
+          <Option name="pix_snmp_server2"></Option>
           <Option name="pix_ssh_timeout">5</Option>
           <Option name="pix_syslog_device_id_opt">string</Option>
           <Option name="pix_syslog_device_id_val">real_firewall</Option>
@@ -9888,12 +9673,12 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">2 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
-          <Option name="snmp_contact"/>
+          <Option name="snmp_contact"></Option>
           <Option name="snmp_description">Cisco PIX Firewall Version 6.2(2)
 </Option>
-          <Option name="snmp_location"/>
+          <Option name="snmp_location"></Option>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
           <Option name="uauth_abs">True</Option>
           <Option name="uauth_hh">0</Option>
@@ -9958,11 +9743,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -10541,11 +10324,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id444A03B19567" disabled="True" group="" log="True" position="1" action="Deny" direction="Inbound" comment="">
             <Src neg="False">
@@ -10560,13 +10341,10 @@ no sysopt nodnsalias outbound
             <Itf neg="False">
               <ObjectRef ref="id444A05A19567"/>
             </Itf>
-            
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id444A03BB9567" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -10585,9 +10363,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id444A03C79567" disabled="False" group="" log="True" position="3" action="Accept" direction="Outbound" comment="anti-spoofing rule">
             <Src neg="False">
@@ -10607,9 +10384,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id444A03D49567" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -10624,11 +10400,9 @@ no sysopt nodnsalias outbound
             <Itf neg="False">
               <ObjectRef ref="id444A05A49567"/>
             </Itf>
-            
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id444A03DE9567" disabled="False" group="" log="False" position="5" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -10644,11 +10418,9 @@ no sysopt nodnsalias outbound
             <Itf neg="False">
               <ObjectRef ref="id444A05A49567"/>
             </Itf>
-            
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id444A03E99567" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="">
             <Src neg="False">
@@ -10667,11 +10439,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id444A03F59567" disabled="True" group="" log="True" position="7" action="Deny" direction="Both" comment="this rule, if enabled, shades&#10;some rule below because&#10;of service &quot;any ICMP&quot;">
             <Src neg="False">
@@ -10692,15 +10462,13 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"/>
-              <Option name="log_prefix"/>
+              <Option name="log_limit_suffix"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id444A04039567" disabled="False" group="" log="False" position="8" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -10719,9 +10487,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id444A040F9567" disabled="False" group="" log="False" position="9" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -10740,14 +10507,12 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id444A041B9567" disabled="False" group="" log="True" position="10" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -10767,15 +10532,13 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"/>
-              <Option name="log_prefix"/>
+              <Option name="log_limit_suffix"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id444A04289567" disabled="True" group="" log="False" position="11" action="Deny" direction="Both" comment="shades rule #8 below">
             <Src neg="False">
@@ -10794,11 +10557,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id444A04349567" disabled="False" group="" log="False" position="12" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -10819,14 +10580,12 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id444A04429567" disabled="False" group="" log="False" position="13" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -10845,9 +10604,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id444A044E9567" disabled="False" group="" log="False" position="14" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -10866,9 +10624,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id444A045A9567" disabled="False" group="" log="False" position="15" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -10888,9 +10645,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id444A04679567" disabled="False" group="" log="False" position="16" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -10910,14 +10666,12 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id444A04749567" disabled="False" group="" log="False" position="17" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -10937,14 +10691,12 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id444A04819567" disabled="False" group="" log="False" position="18" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -10964,14 +10716,12 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id444A048E9567" disabled="False" group="" log="False" position="19" action="Accept" direction="Both" comment="objects hostA and hostB are&#10;redundant and should be removed by&#10; removeRedundantAddressesFromDst">
             <Src neg="False">
@@ -10992,14 +10742,12 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id444A049C9567" disabled="False" group="" log="False" position="20" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -11018,9 +10766,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id444A04A89567" disabled="True" group="" log="False" position="21" action="Accept" direction="Both" comment="rules 12 and 13 can be&#10;used to test shading">
             <Src neg="False">
@@ -11039,14 +10786,12 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id444A04B49567" disabled="True" group="" log="False" position="22" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -11065,14 +10810,12 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id444A04C09567" disabled="False" group="" log="True" position="23" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -11091,9 +10834,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id444A04CC9567" disabled="False" group="" log="False" position="24" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -11113,14 +10855,12 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id444A04D99567" disabled="False" group="" log="True" position="25" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -11139,16 +10879,14 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"/>
-              <Option name="log_prefix"/>
+              <Option name="log_limit_suffix"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -11176,12 +10914,12 @@ no sysopt nodnsalias outbound
           <Option name="accept_established">False</Option>
           <Option name="accept_new_tcp_with_no_syn">False</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">True</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="cmdline">-v</Option>
-          <Option name="compiler"/>
+          <Option name="compiler"></Option>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -11190,7 +10928,7 @@ no sysopt nodnsalias outbound
           <Option name="dns_fixup">2 65535 0 nil 0</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
-          <Option name="firewall_dir"/>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ftp_fixup">0 21 0 strict 0</Option>
@@ -11207,9 +10945,9 @@ no sysopt nodnsalias outbound
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">0 389 389 nil 0</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/second</Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">0</Option>
@@ -11221,12 +10959,12 @@ no sysopt nodnsalias outbound
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modulate_state">False</Option>
           <Option name="no_iochains_for_any">False</Option>
@@ -11235,7 +10973,7 @@ no sysopt nodnsalias outbound
           <Option name="openbsd_ip_forward">1</Option>
           <Option name="openbsd_ip_redirect">0</Option>
           <Option name="openbsd_ip_sourceroute">0</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">False</Option>
           <Option name="pix_acl_basic">False</Option>
           <Option name="pix_acl_no_clear">False</Option>
@@ -11259,7 +10997,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
           <Option name="pix_enable_snmp_traps">True</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_floodguard">False</Option>
           <Option name="pix_fragguard">True</Option>
           <Option name="pix_h323_abs">True</Option>
@@ -11280,9 +11018,9 @@ no sysopt nodnsalias outbound
           <Option name="pix_nodnsalias_outbound">True</Option>
           <Option name="pix_ntp1">192.168.1.20</Option>
           <Option name="pix_ntp1_pref">True</Option>
-          <Option name="pix_ntp2"/>
+          <Option name="pix_ntp2"></Option>
           <Option name="pix_ntp2_pref">False</Option>
-          <Option name="pix_ntp3"/>
+          <Option name="pix_ntp3"></Option>
           <Option name="pix_ntp3_pref">False</Option>
           <Option name="pix_optimize_default_nat">True</Option>
           <Option name="pix_prolog_script">	
@@ -11350,7 +11088,7 @@ no sysopt nodnsalias outbound
           <Option name="rpc_ss">0</Option>
           <Option name="rsh_fixup">0 514 0 nil 0</Option>
           <Option name="rtsp_fixup">0 554 0 nil 0</Option>
-          <Option name="script_env_path"/>
+          <Option name="script_env_path"></Option>
           <Option name="sip_fixup">0 5060 5060 nil 0</Option>
           <Option name="sip_hh">0</Option>
           <Option name="sip_media_hh">0</Option>
@@ -11361,11 +11099,11 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">0 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">0 25 25 nil 0</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="sqlnet_fixup">0 1521 1521 nil 0</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
@@ -11543,11 +11281,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id43867C2418346" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -11566,9 +11302,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id43869E9018346" disabled="True" group="" log="False" position="2" action="Accept" direction="Both" comment="run time objects are not supported">
             <Src neg="False">
@@ -11587,9 +11322,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id43869E9E18346" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -11608,9 +11342,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id43869EAA18346" disabled="False" group="" log="False" position="4" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -11629,9 +11362,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4386E38318346" disabled="False" group="" log="False" position="5" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -11650,11 +11382,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4386E37718346" disabled="True" group="" log="False" position="6" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -11673,11 +11403,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id43867C3018346" disabled="False" group="" log="False" position="7" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -11696,9 +11424,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4386C10D18346" disabled="False" group="" log="False" position="8" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -11717,9 +11444,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id438728A918346" disabled="False" group="" log="False" position="9" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -11739,9 +11465,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id438728BA18346" disabled="True" group="" log="False" position="10" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -11761,9 +11486,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id43867C3C18346" disabled="False" group="" log="True" position="11" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -11782,11 +11506,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -11809,50 +11531,50 @@ no sysopt nodnsalias outbound
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="epilog_script"/>
-          <Option name="firewall_dir"/>
+          <Option name="epilog_script"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">False</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -11866,20 +11588,20 @@ no sysopt nodnsalias outbound
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="platform">iptables</Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"/>
+          <Option name="prolog_script"></Option>
           <Option name="proxy_arp">False</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
-          <Option name="sshArgs"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -11966,9 +11688,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4389EDB518346" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -11987,9 +11708,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4390C25825682" disabled="False" group="" log="True" position="2" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -12008,11 +11728,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4389EDC118346" disabled="False" group="" log="False" position="3" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -12032,11 +11750,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id43920D5025682" disabled="False" group="" log="False" position="4" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -12056,11 +11772,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4388CFF8674" disabled="False" group="" log="True" position="5" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -12079,11 +11793,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4388C36F674" disabled="False" group="" log="True" position="6" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -12103,11 +11815,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4388F5A9674" disabled="False" group="" log="False" position="7" action="Accept" direction="Both" comment="">
             <Src neg="True">
@@ -12127,9 +11837,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id21263X16880" disabled="False" group="" log="False" position="8" action="Deny" direction="Both" comment="for #1917&#10;">
             <Src neg="False">
@@ -12150,11 +11859,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4392312525682" disabled="False" group="" log="False" position="9" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -12174,9 +11881,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4389EEA118346" disabled="False" group="" log="False" position="10" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -12195,9 +11901,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4389EDCD18346" disabled="False" group="" log="False" position="11" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -12216,9 +11921,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4389EE3C18346" disabled="False" group="" log="True" position="12" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -12237,11 +11941,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -12264,50 +11966,50 @@ no sysopt nodnsalias outbound
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="epilog_script"/>
-          <Option name="firewall_dir"/>
+          <Option name="epilog_script"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">False</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -12321,20 +12023,20 @@ no sysopt nodnsalias outbound
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="platform">iptables</Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"/>
+          <Option name="prolog_script"></Option>
           <Option name="proxy_arp">False</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
-          <Option name="sshArgs"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -12803,11 +12505,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id45142F7928543" disabled="True" group="" log="True" position="1" action="Deny" direction="Inbound" comment="">
             <Src neg="False">
@@ -12822,13 +12522,10 @@ no sysopt nodnsalias outbound
             <Itf neg="False">
               <ObjectRef ref="id4514316928543"/>
             </Itf>
-            
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id45142F8328543" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -12847,9 +12544,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id45142F8F28543" disabled="False" group="" log="True" position="3" action="Accept" direction="Outbound" comment="anti-spoofing rule">
             <Src neg="False">
@@ -12869,9 +12565,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id45142F9C28543" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -12886,11 +12581,9 @@ no sysopt nodnsalias outbound
             <Itf neg="False">
               <ObjectRef ref="id4514316C28543"/>
             </Itf>
-            
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id45142FA628543" disabled="False" group="" log="False" position="5" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -12906,11 +12599,9 @@ no sysopt nodnsalias outbound
             <Itf neg="False">
               <ObjectRef ref="id4514316C28543"/>
             </Itf>
-            
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id45142FB128543" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="">
             <Src neg="False">
@@ -12929,11 +12620,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id45142FBD28543" disabled="True" group="" log="True" position="7" action="Deny" direction="Both" comment="this rule, if enabled, shades&#10;some rule below because&#10;of service &quot;any ICMP&quot;">
             <Src neg="False">
@@ -12954,15 +12643,13 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"/>
-              <Option name="log_prefix"/>
+              <Option name="log_limit_suffix"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4520B7DA6873" disabled="False" group="" log="False" position="8" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -12981,9 +12668,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id452039FA6873" disabled="False" group="" log="False" position="9" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -13003,9 +12689,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id45142FCB28543" disabled="False" group="" log="False" position="10" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -13024,9 +12709,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id45142FD728543" disabled="False" group="" log="False" position="11" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -13045,14 +12729,12 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id45142FE328543" disabled="False" group="" log="True" position="12" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -13072,15 +12754,13 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"/>
-              <Option name="log_prefix"/>
+              <Option name="log_limit_suffix"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id45142FF028543" disabled="True" group="" log="False" position="13" action="Deny" direction="Both" comment="shades rule #8 below">
             <Src neg="False">
@@ -13099,11 +12779,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id45142FFC28543" disabled="False" group="" log="False" position="14" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -13124,14 +12802,12 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4514300A28543" disabled="False" group="" log="False" position="15" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -13150,9 +12826,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4514301628543" disabled="False" group="" log="False" position="16" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -13171,9 +12846,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4514302228543" disabled="False" group="" log="False" position="17" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -13193,9 +12867,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4514302F28543" disabled="False" group="" log="False" position="18" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -13215,14 +12888,12 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4514303C28543" disabled="False" group="" log="False" position="19" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -13242,14 +12913,12 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4514304928543" disabled="False" group="" log="False" position="20" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -13269,14 +12938,12 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4514305628543" disabled="False" group="" log="False" position="21" action="Accept" direction="Both" comment="objects hostA and hostB are&#10;redundant and should be removed by&#10; removeRedundantAddressesFromDst">
             <Src neg="False">
@@ -13297,14 +12964,12 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4514306428543" disabled="False" group="" log="False" position="22" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -13325,9 +12990,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4514307028543" disabled="True" group="" log="False" position="23" action="Accept" direction="Both" comment="rules 12 and 13 can be&#10;used to test shading">
             <Src neg="False">
@@ -13346,14 +13010,12 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4514307C28543" disabled="True" group="" log="False" position="24" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -13372,14 +13034,12 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4514308828543" disabled="False" group="" log="True" position="25" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -13398,9 +13058,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id453F3A0010039" disabled="False" group="" log="False" position="26" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -13419,9 +13078,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4514309428543" disabled="False" group="" log="False" position="27" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -13441,14 +13099,12 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id16752X44786" disabled="False" group="" log="True" position="28" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -13467,11 +13123,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id451430A128543" disabled="False" group="" log="True" position="29" action="Deny" direction="Inbound" comment="">
             <Src neg="False">
@@ -13491,16 +13145,14 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"/>
-              <Option name="log_prefix"/>
+              <Option name="log_limit_suffix"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -13528,12 +13180,12 @@ no sysopt nodnsalias outbound
           <Option name="accept_established">False</Option>
           <Option name="accept_new_tcp_with_no_syn">False</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="cmdline">-v</Option>
-          <Option name="compiler"/>
+          <Option name="compiler"></Option>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -13542,7 +13194,7 @@ no sysopt nodnsalias outbound
           <Option name="dns_fixup">2 65535 0 nil 0</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
-          <Option name="firewall_dir"/>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ftp_fixup">0 21 0 strict 0</Option>
@@ -13559,9 +13211,9 @@ no sysopt nodnsalias outbound
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">0 389 389 nil 0</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/second</Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">0</Option>
@@ -13573,12 +13225,12 @@ no sysopt nodnsalias outbound
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modulate_state">False</Option>
           <Option name="no_iochains_for_any">False</Option>
@@ -13587,7 +13239,7 @@ no sysopt nodnsalias outbound
           <Option name="openbsd_ip_forward">1</Option>
           <Option name="openbsd_ip_redirect">0</Option>
           <Option name="openbsd_ip_sourceroute">0</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">False</Option>
           <Option name="pix_acl_basic">False</Option>
           <Option name="pix_acl_no_clear">False</Option>
@@ -13611,7 +13263,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
           <Option name="pix_enable_snmp_traps">True</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_floodguard">False</Option>
           <Option name="pix_fragguard">True</Option>
           <Option name="pix_generate_out_acl">False</Option>
@@ -13633,9 +13285,9 @@ no sysopt nodnsalias outbound
           <Option name="pix_nodnsalias_outbound">True</Option>
           <Option name="pix_ntp1">192.168.1.20</Option>
           <Option name="pix_ntp1_pref">True</Option>
-          <Option name="pix_ntp2"/>
+          <Option name="pix_ntp2"></Option>
           <Option name="pix_ntp2_pref">False</Option>
-          <Option name="pix_ntp3"/>
+          <Option name="pix_ntp3"></Option>
           <Option name="pix_ntp3_pref">False</Option>
           <Option name="pix_optimize_default_nat">True</Option>
           <Option name="pix_prolog_script">	
@@ -13668,8 +13320,8 @@ no sysopt nodnsalias outbound
           <Option name="pix_snmp_server1">192.168.1.20</Option>
           <Option name="pix_snmp_server2">192.168.1.22</Option>
           <Option name="pix_ssh_timeout">5</Option>
-          <Option name="pix_syslog_device_id_opt"/>
-          <Option name="pix_syslog_device_id_val"/>
+          <Option name="pix_syslog_device_id_opt"></Option>
+          <Option name="pix_syslog_device_id_val"></Option>
           <Option name="pix_syslog_facility">16</Option>
           <Option name="pix_syslog_host">192.168.1.30</Option>
           <Option name="pix_syslog_level">error</Option>
@@ -13706,7 +13358,7 @@ no sysopt nodnsalias outbound
           <Option name="rpc_ss">0</Option>
           <Option name="rsh_fixup">0 514 0 nil 0</Option>
           <Option name="rtsp_fixup">0 554 0 nil 0</Option>
-          <Option name="script_env_path"/>
+          <Option name="script_env_path"></Option>
           <Option name="sip_fixup">0 5060 5060 nil 0</Option>
           <Option name="sip_hh">0</Option>
           <Option name="sip_media_hh">0</Option>
@@ -13717,11 +13369,11 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">0 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">0 25 25 nil 0</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="sqlnet_fixup">0 1521 1521 nil 0</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
@@ -13896,9 +13548,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4528A50620039" disabled="False" group="" log="False" position="1" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -13917,9 +13568,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4528A59120039" disabled="False" group="" log="False" position="2" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -13938,9 +13588,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4528A5B020039" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="dmz -&gt; intnet">
             <Src neg="False">
@@ -13959,9 +13608,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4528A5A020039" disabled="False" group="" log="False" position="4" action="Accept" direction="Outbound" comment="dmz -&gt; intnet">
             <Src neg="False">
@@ -13980,9 +13628,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4528BB8A20039" disabled="False" group="" log="False" position="5" action="Accept" direction="Both" comment="dmz -&gt; intnet">
             <Src neg="False">
@@ -14002,9 +13649,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id452912BE20039" disabled="False" group="" log="True" position="6" action="Deny" direction="Inbound" comment="">
             <Src neg="False">
@@ -14025,11 +13671,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529289320039" disabled="False" group="" log="False" position="7" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -14051,9 +13695,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4528A51220039" disabled="False" group="" log="False" position="8" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -14072,11 +13715,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -14101,11 +13742,11 @@ no sysopt nodnsalias outbound
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
         <FirewallOptions>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -14130,13 +13771,13 @@ no sysopt nodnsalias outbound
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">2 389 389 nil 0</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pix_acl_basic">False</Option>
           <Option name="pix_acl_no_clear">True</Option>
           <Option name="pix_acl_substitution">False</Option>
-          <Option name="pix_acl_temp_addr"/>
+          <Option name="pix_acl_temp_addr"></Option>
           <Option name="pix_add_clear_statements">False</Option>
           <Option name="pix_assume_fw_part_of_any">False</Option>
           <Option name="pix_check_duplicate_nat">False</Option>
@@ -14153,7 +13794,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emb_limit">0</Option>
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_floodguard">True</Option>
           <Option name="pix_fragguard">True</Option>
           <Option name="pix_generate_out_acl">False</Option>
@@ -14204,8 +13845,8 @@ no sysopt nodnsalias outbound
           <Option name="pix_sip_mm">30</Option>
           <Option name="pix_sip_ss">0</Option>
           <Option name="pix_ssh_timeout">5</Option>
-          <Option name="pix_syslog_facility"/>
-          <Option name="pix_syslog_host"/>
+          <Option name="pix_syslog_facility"></Option>
+          <Option name="pix_syslog_host"></Option>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">5</Option>
           <Option name="pix_uauth_abs">True</Option>
@@ -14241,11 +13882,11 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">2 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
@@ -14420,10 +14061,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id452955F920039" disabled="False" group="" log="False" position="1" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -14443,10 +14082,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529560A20039" disabled="False" group="" log="False" position="2" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -14466,10 +14103,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id452955E820039" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -14489,10 +14124,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id45293E8E20039" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -14512,10 +14145,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529561B20039" disabled="False" group="" log="False" position="5" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -14535,10 +14166,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id45293E9A20039" disabled="False" group="" log="False" position="6" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -14558,10 +14187,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id45296CFA20039" disabled="False" group="" log="False" position="7" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -14581,10 +14208,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id45296D0B20039" disabled="False" group="" log="False" position="8" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -14604,10 +14229,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529840220039" disabled="False" group="" log="False" position="9" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -14627,10 +14250,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529841320039" disabled="False" group="" log="False" position="10" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -14650,10 +14271,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529842420039" disabled="False" group="" log="False" position="11" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -14673,10 +14292,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id45299B4220039" disabled="False" group="" log="False" position="12" action="Accept" direction="Both" comment="dmz -&gt; intnet">
             <Src neg="False">
@@ -14696,10 +14313,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id45293EA620039" disabled="False" group="" log="False" position="13" action="Accept" direction="Inbound" comment="dmz -&gt; intnet">
             <Src neg="False">
@@ -14719,10 +14334,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id45299B5320039" disabled="False" group="" log="False" position="14" action="Accept" direction="Outbound" comment="dmz -&gt; intnet">
             <Src neg="False">
@@ -14742,10 +14355,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id45299B7520039" disabled="False" group="" log="False" position="15" action="Accept" direction="Both" comment="dmz -&gt; intnet">
             <Src neg="False">
@@ -14765,10 +14376,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id45293EB220039" disabled="False" group="" log="False" position="16" action="Accept" direction="Inbound" comment="dmz -&gt; intnet">
             <Src neg="False">
@@ -14788,10 +14397,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id45299B6420039" disabled="False" group="" log="False" position="17" action="Accept" direction="Outbound" comment="dmz -&gt; intnet">
             <Src neg="False">
@@ -14811,10 +14418,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id45293EBE20039" disabled="False" group="" log="False" position="18" action="Accept" direction="Both" comment="dmz -&gt; intnet">
             <Src neg="False">
@@ -14835,10 +14440,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id45293ECB20039" disabled="False" group="" log="True" position="19" action="Deny" direction="Inbound" comment="">
             <Src neg="False">
@@ -14859,11 +14462,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id45293ED920039" disabled="False" group="" log="False" position="20" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -14885,9 +14486,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id45293EE820039" disabled="False" group="" log="False" position="21" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -14906,11 +14506,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -14935,11 +14533,11 @@ no sysopt nodnsalias outbound
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
         <FirewallOptions>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -14964,13 +14562,13 @@ no sysopt nodnsalias outbound
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">2 389 389 nil 0</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pix_acl_basic">False</Option>
           <Option name="pix_acl_no_clear">True</Option>
           <Option name="pix_acl_substitution">False</Option>
-          <Option name="pix_acl_temp_addr"/>
+          <Option name="pix_acl_temp_addr"></Option>
           <Option name="pix_add_clear_statements">False</Option>
           <Option name="pix_assume_fw_part_of_any">False</Option>
           <Option name="pix_check_duplicate_nat">False</Option>
@@ -14987,7 +14585,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emb_limit">0</Option>
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_floodguard">True</Option>
           <Option name="pix_fragguard">True</Option>
           <Option name="pix_generate_out_acl">False</Option>
@@ -15038,8 +14636,8 @@ no sysopt nodnsalias outbound
           <Option name="pix_sip_mm">30</Option>
           <Option name="pix_sip_ss">0</Option>
           <Option name="pix_ssh_timeout">5</Option>
-          <Option name="pix_syslog_facility"/>
-          <Option name="pix_syslog_host"/>
+          <Option name="pix_syslog_facility"></Option>
+          <Option name="pix_syslog_host"></Option>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">5</Option>
           <Option name="pix_uauth_abs">True</Option>
@@ -15075,11 +14673,11 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">2 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
@@ -15254,10 +14852,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529E35216799" disabled="False" group="" log="False" position="1" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -15277,10 +14873,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529E35E16799" disabled="False" group="" log="False" position="2" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -15300,10 +14894,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529E36A16799" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -15323,10 +14915,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529E37616799" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -15346,10 +14936,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529E38216799" disabled="False" group="" log="False" position="5" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -15369,10 +14957,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529E38E16799" disabled="False" group="" log="False" position="6" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -15392,10 +14978,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529E39A16799" disabled="False" group="" log="False" position="7" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -15415,10 +14999,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529E3A616799" disabled="False" group="" log="False" position="8" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -15438,10 +15020,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529E3B216799" disabled="False" group="" log="False" position="9" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -15461,10 +15041,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529E3BE16799" disabled="False" group="" log="False" position="10" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -15484,10 +15062,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529E3CA16799" disabled="False" group="" log="False" position="11" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -15507,10 +15083,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529E3D616799" disabled="False" group="" log="False" position="12" action="Accept" direction="Both" comment="dmz -&gt; intnet">
             <Src neg="False">
@@ -15530,10 +15104,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529E3E216799" disabled="False" group="" log="False" position="13" action="Accept" direction="Inbound" comment="dmz -&gt; intnet">
             <Src neg="False">
@@ -15553,10 +15125,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529E3EE16799" disabled="False" group="" log="False" position="14" action="Accept" direction="Outbound" comment="dmz -&gt; intnet">
             <Src neg="False">
@@ -15576,10 +15146,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529E3FA16799" disabled="False" group="" log="False" position="15" action="Accept" direction="Both" comment="dmz -&gt; intnet">
             <Src neg="False">
@@ -15599,10 +15167,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529E40616799" disabled="False" group="" log="False" position="16" action="Accept" direction="Inbound" comment="dmz -&gt; intnet">
             <Src neg="False">
@@ -15622,10 +15188,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529E41216799" disabled="False" group="" log="False" position="17" action="Accept" direction="Outbound" comment="dmz -&gt; intnet">
             <Src neg="False">
@@ -15645,10 +15209,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529E41E16799" disabled="False" group="" log="False" position="18" action="Accept" direction="Both" comment="dmz -&gt; intnet">
             <Src neg="False">
@@ -15669,10 +15231,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529E42B16799" disabled="False" group="" log="True" position="19" action="Deny" direction="Inbound" comment="">
             <Src neg="False">
@@ -15693,11 +15253,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529E43916799" disabled="False" group="" log="False" position="20" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -15719,9 +15277,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529E44816799" disabled="False" group="" log="False" position="21" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -15740,11 +15297,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -15769,11 +15324,11 @@ no sysopt nodnsalias outbound
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
         <FirewallOptions>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -15798,13 +15353,13 @@ no sysopt nodnsalias outbound
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">2 389 389 nil 0</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pix_acl_basic">False</Option>
           <Option name="pix_acl_no_clear">True</Option>
           <Option name="pix_acl_substitution">False</Option>
-          <Option name="pix_acl_temp_addr"/>
+          <Option name="pix_acl_temp_addr"></Option>
           <Option name="pix_add_clear_statements">False</Option>
           <Option name="pix_assume_fw_part_of_any">False</Option>
           <Option name="pix_check_duplicate_nat">False</Option>
@@ -15821,7 +15376,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emb_limit">0</Option>
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_floodguard">True</Option>
           <Option name="pix_fragguard">True</Option>
           <Option name="pix_generate_out_acl">True</Option>
@@ -15872,10 +15427,10 @@ no sysopt nodnsalias outbound
           <Option name="pix_sip_mm">30</Option>
           <Option name="pix_sip_ss">0</Option>
           <Option name="pix_ssh_timeout">5</Option>
-          <Option name="pix_syslog_device_id_opt"/>
-          <Option name="pix_syslog_device_id_val"/>
-          <Option name="pix_syslog_facility"/>
-          <Option name="pix_syslog_host"/>
+          <Option name="pix_syslog_device_id_opt"></Option>
+          <Option name="pix_syslog_device_id_val"></Option>
+          <Option name="pix_syslog_facility"></Option>
+          <Option name="pix_syslog_host"></Option>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">5</Option>
           <Option name="pix_uauth_abs">True</Option>
@@ -15911,11 +15466,11 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">2 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
@@ -16090,10 +15645,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529FD5D16799" disabled="False" group="" log="False" position="1" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -16113,10 +15666,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529FD6916799" disabled="False" group="" log="False" position="2" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -16136,10 +15687,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529FD7516799" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -16159,10 +15708,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529FD8116799" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -16182,10 +15729,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529FD8D16799" disabled="False" group="" log="False" position="5" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -16205,10 +15750,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529FD9916799" disabled="False" group="" log="False" position="6" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -16228,10 +15771,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529FDA516799" disabled="False" group="" log="False" position="7" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -16251,10 +15792,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529FDB116799" disabled="False" group="" log="False" position="8" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -16274,10 +15813,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529FDBD16799" disabled="False" group="" log="False" position="9" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -16297,10 +15834,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529FDC916799" disabled="False" group="" log="False" position="10" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -16320,10 +15855,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529FDD516799" disabled="False" group="" log="False" position="11" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -16343,10 +15876,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529FDE116799" disabled="False" group="" log="False" position="12" action="Accept" direction="Both" comment="dmz -&gt; intnet">
             <Src neg="False">
@@ -16366,10 +15897,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529FDED16799" disabled="False" group="" log="False" position="13" action="Accept" direction="Inbound" comment="dmz -&gt; intnet">
             <Src neg="False">
@@ -16389,10 +15918,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529FDF916799" disabled="False" group="" log="False" position="14" action="Accept" direction="Outbound" comment="dmz -&gt; intnet">
             <Src neg="False">
@@ -16412,10 +15939,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529FE0516799" disabled="False" group="" log="False" position="15" action="Accept" direction="Both" comment="dmz -&gt; intnet">
             <Src neg="False">
@@ -16435,10 +15960,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529FE1116799" disabled="False" group="" log="False" position="16" action="Accept" direction="Inbound" comment="dmz -&gt; intnet">
             <Src neg="False">
@@ -16458,10 +15981,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529FE1D16799" disabled="False" group="" log="False" position="17" action="Accept" direction="Outbound" comment="dmz -&gt; intnet">
             <Src neg="False">
@@ -16481,10 +16002,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529FE2916799" disabled="False" group="" log="False" position="18" action="Accept" direction="Both" comment="dmz -&gt; intnet">
             <Src neg="False">
@@ -16505,10 +16024,8 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529FE3616799" disabled="False" group="" log="True" position="19" action="Deny" direction="Inbound" comment="">
             <Src neg="False">
@@ -16529,11 +16046,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529FE4416799" disabled="False" group="" log="False" position="20" action="Accept" direction="Outbound" comment="">
             <Src neg="False">
@@ -16555,9 +16070,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4529FE5316799" disabled="False" group="" log="False" position="21" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -16576,11 +16090,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -16605,11 +16117,11 @@ no sysopt nodnsalias outbound
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
         <FirewallOptions>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -16634,13 +16146,13 @@ no sysopt nodnsalias outbound
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">2 389 389 nil 0</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pix_acl_basic">False</Option>
           <Option name="pix_acl_no_clear">True</Option>
           <Option name="pix_acl_substitution">False</Option>
-          <Option name="pix_acl_temp_addr"/>
+          <Option name="pix_acl_temp_addr"></Option>
           <Option name="pix_add_clear_statements">False</Option>
           <Option name="pix_assume_fw_part_of_any">False</Option>
           <Option name="pix_check_duplicate_nat">False</Option>
@@ -16657,7 +16169,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emb_limit">0</Option>
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_floodguard">True</Option>
           <Option name="pix_fragguard">True</Option>
           <Option name="pix_generate_out_acl">False</Option>
@@ -16708,8 +16220,8 @@ no sysopt nodnsalias outbound
           <Option name="pix_sip_mm">30</Option>
           <Option name="pix_sip_ss">0</Option>
           <Option name="pix_ssh_timeout">5</Option>
-          <Option name="pix_syslog_facility"/>
-          <Option name="pix_syslog_host"/>
+          <Option name="pix_syslog_facility"></Option>
+          <Option name="pix_syslog_host"></Option>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">5</Option>
           <Option name="pix_uauth_abs">True</Option>
@@ -16745,11 +16257,11 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">2 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
@@ -16843,9 +16355,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id47B93E1C21818" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -16864,11 +16375,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id47B8824321818" disabled="True" group="" log="False" position="2" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -16889,11 +16398,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id47B7A6E321818" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -16912,9 +16419,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id47B7A6FB21818" disabled="False" group="" log="False" position="4" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -16933,9 +16439,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id47B7A70721818" disabled="False" group="" log="True" position="5" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -16954,9 +16459,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -17005,7 +16509,7 @@ no sysopt nodnsalias outbound
           <Option name="accept_new_tcp_with_no_syn">true</Option>
           <Option name="add_check_state_rule">true</Option>
           <Option name="admUser">vadim</Option>
-          <Option name="altAddress"/>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
           <Option name="configure_interfaces">true</Option>
           <Option name="conn_hh">0</Option>
@@ -17048,7 +16552,7 @@ no sysopt nodnsalias outbound
           <Option name="mgmt_addr">10.3.14.42</Option>
           <Option name="mgmt_ssh">True</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">false</Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
@@ -17070,7 +16574,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emb_limit">0</Option>
           <Option name="pix_emblem_log_format">True</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_floodguard">True</Option>
           <Option name="pix_fragguard">False</Option>
           <Option name="pix_generate_out_acl">False</Option>
@@ -17078,14 +16582,14 @@ no sysopt nodnsalias outbound
           <Option name="pix_logging_buffered">True</Option>
           <Option name="pix_logging_buffered_level">6</Option>
           <Option name="pix_logging_console">False</Option>
-          <Option name="pix_logging_console_level"/>
+          <Option name="pix_logging_console_level"></Option>
           <Option name="pix_logging_timestamp">True</Option>
-          <Option name="pix_logging_trap_level"/>
+          <Option name="pix_logging_trap_level"></Option>
           <Option name="pix_max_conns">0</Option>
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
           <Option name="pix_optimize_default_nat">False</Option>
-          <Option name="pix_prolog_script"/>
+          <Option name="pix_prolog_script"></Option>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">True</Option>
           <Option name="pix_resetinbound">False</Option>
@@ -17097,9 +16601,9 @@ no sysopt nodnsalias outbound
           <Option name="pix_ssh_timeout">0</Option>
           <Option name="pix_syslog_device_id_opt">hostname</Option>
           <Option name="pix_syslog_device_id_supported">false</Option>
-          <Option name="pix_syslog_device_id_val"/>
-          <Option name="pix_syslog_facility"/>
-          <Option name="pix_syslog_host"/>
+          <Option name="pix_syslog_device_id_val"></Option>
+          <Option name="pix_syslog_facility"></Option>
+          <Option name="pix_syslog_host"></Option>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">0</Option>
           <Option name="pix_use_acl_remarks">True</Option>
@@ -17124,7 +16628,7 @@ no sysopt nodnsalias outbound
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
           <Option name="solaris_ip_forward">1</Option>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
           <Option name="uauth_abs">False</Option>
           <Option name="uauth_hh">0</Option>
@@ -17518,11 +17022,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id17253X54624" disabled="True" group="" log="True" position="1" action="Deny" direction="Inbound" comment="">
             <Src neg="False">
@@ -17537,13 +17039,10 @@ no sysopt nodnsalias outbound
             <Itf neg="False">
               <ObjectRef ref="id17225X54624"/>
             </Itf>
-            
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id17263X54624" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -17562,9 +17061,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id17275X54624" disabled="False" group="" log="True" position="3" action="Accept" direction="Outbound" comment="anti-spoofing rule">
             <Src neg="False">
@@ -17584,9 +17082,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id17288X54624" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -17601,11 +17098,9 @@ no sysopt nodnsalias outbound
             <Itf neg="False">
               <ObjectRef ref="id17230X54624"/>
             </Itf>
-            
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id17298X54624" disabled="False" group="" log="False" position="5" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -17621,11 +17116,9 @@ no sysopt nodnsalias outbound
             <Itf neg="False">
               <ObjectRef ref="id17230X54624"/>
             </Itf>
-            
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id17309X54624" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="">
             <Src neg="False">
@@ -17644,11 +17137,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id17321X54624" disabled="True" group="" log="True" position="7" action="Deny" direction="Both" comment="this rule, if enabled, shades&#10;some rule below because&#10;of service &quot;any ICMP&quot;">
             <Src neg="False">
@@ -17669,15 +17160,13 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"/>
-              <Option name="log_prefix"/>
+              <Option name="log_limit_suffix"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id17335X54624" disabled="False" group="" log="False" position="8" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -17696,9 +17185,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id17347X54624" disabled="False" group="" log="False" position="9" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -17717,14 +17205,12 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id17359X54624" disabled="False" group="" log="True" position="10" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -17744,15 +17230,13 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"/>
-              <Option name="log_prefix"/>
+              <Option name="log_limit_suffix"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id17372X54624" disabled="True" group="" log="False" position="11" action="Deny" direction="Both" comment="shades rule #8 below">
             <Src neg="False">
@@ -17771,11 +17255,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id17384X54624" disabled="False" group="" log="False" position="12" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -17796,14 +17278,12 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id17398X54624" disabled="False" group="" log="False" position="13" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -17822,9 +17302,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id17410X54624" disabled="False" group="" log="False" position="14" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -17843,9 +17322,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id17422X54624" disabled="False" group="" log="False" position="15" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -17865,9 +17343,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id17435X54624" disabled="False" group="" log="False" position="16" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -17887,14 +17364,12 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id17448X54624" disabled="False" group="" log="False" position="17" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -17914,14 +17389,12 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id17461X54624" disabled="False" group="" log="False" position="18" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -17941,14 +17414,12 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id17474X54624" disabled="False" group="" log="False" position="19" action="Accept" direction="Both" comment="objects hostA and hostB are&#10;redundant and should be removed by&#10; removeRedundantAddressesFromDst">
             <Src neg="False">
@@ -17969,14 +17440,12 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id17488X54624" disabled="False" group="" log="False" position="20" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -17995,9 +17464,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id17500X54624" disabled="True" group="" log="False" position="21" action="Accept" direction="Both" comment="rules 12 and 13 can be&#10;used to test shading">
             <Src neg="False">
@@ -18016,14 +17484,12 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id17512X54624" disabled="True" group="" log="False" position="22" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -18042,14 +17508,12 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id17524X54624" disabled="False" group="" log="True" position="23" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -18068,9 +17532,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id17536X54624" disabled="False" group="" log="False" position="24" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -18090,14 +17553,12 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id17549X54624" disabled="False" group="" log="True" position="25" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -18116,16 +17577,14 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"/>
-              <Option name="log_prefix"/>
+              <Option name="log_limit_suffix"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -18153,12 +17612,12 @@ no sysopt nodnsalias outbound
           <Option name="accept_established">False</Option>
           <Option name="accept_new_tcp_with_no_syn">False</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">True</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="cmdline">-v</Option>
-          <Option name="compiler"/>
+          <Option name="compiler"></Option>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -18167,7 +17626,7 @@ no sysopt nodnsalias outbound
           <Option name="dns_fixup">2 65535 0 nil 0</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
-          <Option name="firewall_dir"/>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ftp_fixup">0 21 0 strict 0</Option>
@@ -18184,9 +17643,9 @@ no sysopt nodnsalias outbound
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">0 389 389 nil 0</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/second</Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">0</Option>
@@ -18198,12 +17657,12 @@ no sysopt nodnsalias outbound
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modulate_state">False</Option>
           <Option name="no_iochains_for_any">False</Option>
@@ -18212,7 +17671,7 @@ no sysopt nodnsalias outbound
           <Option name="openbsd_ip_forward">1</Option>
           <Option name="openbsd_ip_redirect">0</Option>
           <Option name="openbsd_ip_sourceroute">0</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">False</Option>
           <Option name="pix_acl_basic">False</Option>
           <Option name="pix_acl_no_clear">False</Option>
@@ -18236,7 +17695,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
           <Option name="pix_enable_snmp_traps">True</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_floodguard">False</Option>
           <Option name="pix_fragguard">True</Option>
           <Option name="pix_h323_abs">True</Option>
@@ -18257,9 +17716,9 @@ no sysopt nodnsalias outbound
           <Option name="pix_nodnsalias_outbound">True</Option>
           <Option name="pix_ntp1">192.168.1.20</Option>
           <Option name="pix_ntp1_pref">True</Option>
-          <Option name="pix_ntp2"/>
+          <Option name="pix_ntp2"></Option>
           <Option name="pix_ntp2_pref">False</Option>
-          <Option name="pix_ntp3"/>
+          <Option name="pix_ntp3"></Option>
           <Option name="pix_ntp3_pref">False</Option>
           <Option name="pix_optimize_default_nat">True</Option>
           <Option name="pix_prolog_script">	
@@ -18327,7 +17786,7 @@ no sysopt nodnsalias outbound
           <Option name="rpc_ss">0</Option>
           <Option name="rsh_fixup">0 514 0 nil 0</Option>
           <Option name="rtsp_fixup">0 554 0 nil 0</Option>
-          <Option name="script_env_path"/>
+          <Option name="script_env_path"></Option>
           <Option name="sip_fixup">0 5060 5060 nil 0</Option>
           <Option name="sip_hh">0</Option>
           <Option name="sip_media_hh">0</Option>
@@ -18338,11 +17797,11 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">0 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">0 25 25 nil 0</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="sqlnet_fixup">0 1521 1521 nil 0</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
@@ -18410,11 +17869,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -18666,11 +18123,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -18922,11 +18377,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -19177,11 +18630,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id18884X29796" disabled="False" group="" log="False" position="1" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -19200,9 +18651,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id18908X29796" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -19221,9 +18671,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id18896X29796" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -19242,9 +18691,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id19186X29796" disabled="False" group="" log="False" position="4" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -19270,11 +18718,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id19083X1497" disabled="False" group="" log="False" position="5" action="Deny" direction="Both" comment="matching source ports">
             <Src neg="False">
@@ -19294,11 +18740,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id19147X2900" disabled="False" group="" log="False" position="6" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -19318,11 +18762,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id69378X1497" disabled="False" group="" log="False" position="7" action="Deny" direction="Both" comment="matching &quot;any&quot; icmp and &quot;all&quot; tcp &#10;in one service-group&#10;&#10;">
             <Src neg="False">
@@ -19342,11 +18784,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id21447X11252" disabled="False" group="" log="False" position="8" action="Accept" direction="Both" comment="for #1938 matching&#10;mixed services">
             <Src neg="False">
@@ -19368,11 +18808,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id21584X21575" disabled="False" group="" log="False" position="9" action="Deny" direction="Both" comment="for #1942&#10;using custom service">
             <Src neg="False">
@@ -19392,11 +18830,9 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id79024X21575" disabled="False" group="" log="False" position="10" action="Deny" direction="Both" comment="for #1942&#10;using custom service">
             <Src neg="False">
@@ -19417,11 +18853,9 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id18920X29796" disabled="False" group="" log="False" position="11" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -19440,11 +18874,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -19468,12 +18900,12 @@ no sysopt nodnsalias outbound
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -19482,8 +18914,8 @@ no sysopt nodnsalias outbound
           <Option name="dns_fixup">2 65535 0 nil 0</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
-          <Option name="filesystem"/>
-          <Option name="firewall_dir"/>
+          <Option name="filesystem"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ftp_fixup">2 21 0 strict 0</Option>
@@ -19500,9 +18932,9 @@ no sysopt nodnsalias outbound
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">2 389 389 nil 0</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="ip_options_eool_fixup">0 0 0 nil 0</Option>
           <Option name="ip_options_nop_fixup">1 0 0 nil 0</Option>
           <Option name="ip_options_rtralt">2 0 0 nil 0</Option>
@@ -19519,22 +18951,22 @@ no sysopt nodnsalias outbound
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modulate_state">False</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">False</Option>
           <Option name="pix_acl_basic">True</Option>
           <Option name="pix_acl_no_clear">False</Option>
           <Option name="pix_acl_substitution">False</Option>
-          <Option name="pix_acl_temp_addr"/>
+          <Option name="pix_acl_temp_addr"></Option>
           <Option name="pix_add_clear_statements">True</Option>
           <Option name="pix_assume_fw_part_of_any">True</Option>
           <Option name="pix_check_duplicate_nat">False</Option>
@@ -19546,7 +18978,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emb_limit">0</Option>
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_floodguard">False</Option>
           <Option name="pix_fragguard">False</Option>
           <Option name="pix_generate_out_acl">False</Option>
@@ -19562,7 +18994,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
           <Option name="pix_optimize_default_nat">False</Option>
-          <Option name="pix_prolog_script"/>
+          <Option name="pix_prolog_script"></Option>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">True</Option>
           <Option name="pix_resetinbound">False</Option>
@@ -19570,10 +19002,10 @@ no sysopt nodnsalias outbound
           <Option name="pix_route_dnat">False</Option>
           <Option name="pix_set_host_name">False</Option>
           <Option name="pix_ssh_timeout">0</Option>
-          <Option name="pix_syslog_device_id_opt"/>
-          <Option name="pix_syslog_device_id_val"/>
-          <Option name="pix_syslog_facility"/>
-          <Option name="pix_syslog_host"/>
+          <Option name="pix_syslog_device_id_opt"></Option>
+          <Option name="pix_syslog_device_id_val"></Option>
+          <Option name="pix_syslog_facility"></Option>
+          <Option name="pix_syslog_host"></Option>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">0</Option>
           <Option name="pix_use_acl_remarks">False</Option>
@@ -19586,8 +19018,8 @@ no sysopt nodnsalias outbound
           <Option name="rpc_ss">0</Option>
           <Option name="rsh_fixup">2 514 0 nil 0</Option>
           <Option name="rtsp_fixup">2 554 0 nil 0</Option>
-          <Option name="scpArgs"/>
-          <Option name="script_env_path"/>
+          <Option name="scpArgs"></Option>
+          <Option name="script_env_path"></Option>
           <Option name="short_script">False</Option>
           <Option name="sip_fixup">2 5060 5060 nil 0</Option>
           <Option name="sip_hh">0</Option>
@@ -19599,11 +19031,11 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">2 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
@@ -19673,11 +19105,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id138419X27607" disabled="False" group="" log="False" position="1" action="Accept" direction="Inbound" comment="test rule using translated address in dst&#10;">
             <Src neg="False">
@@ -19696,11 +19126,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id86746X27607" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="test rule using translated address in dst&#10;">
             <Src neg="False">
@@ -19719,11 +19147,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id241104X27607" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="test rule using translated address in dst&#10;">
             <Src neg="False">
@@ -19742,11 +19168,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id127389X26962" disabled="False" group="" log="False" position="4" action="Deny" direction="Both" comment="for #1942&#10;using custom service">
             <Src neg="False">
@@ -19766,11 +19190,9 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id127342X26962" disabled="False" group="" log="False" position="5" action="Deny" direction="Both" comment="for #1942&#10;using custom service">
             <Src neg="False">
@@ -19791,11 +19213,9 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id86758X27607" disabled="False" group="" log="False" position="6" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -19814,11 +19234,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -19842,12 +19260,12 @@ no sysopt nodnsalias outbound
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -19856,8 +19274,8 @@ no sysopt nodnsalias outbound
           <Option name="dns_fixup">2 65535 0 nil 0</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
-          <Option name="filesystem"/>
-          <Option name="firewall_dir"/>
+          <Option name="filesystem"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ftp_fixup">2 21 0 strict 0</Option>
@@ -19874,9 +19292,9 @@ no sysopt nodnsalias outbound
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">2 389 389 nil 0</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="ip_options_eool_fixup">0 0 0 nil 0</Option>
           <Option name="ip_options_nop_fixup">1 0 0 nil 0</Option>
           <Option name="ip_options_rtralt">2 0 0 nil 0</Option>
@@ -19893,22 +19311,22 @@ no sysopt nodnsalias outbound
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modulate_state">False</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">False</Option>
           <Option name="pix_acl_basic">True</Option>
           <Option name="pix_acl_no_clear">False</Option>
           <Option name="pix_acl_substitution">False</Option>
-          <Option name="pix_acl_temp_addr"/>
+          <Option name="pix_acl_temp_addr"></Option>
           <Option name="pix_add_clear_statements">True</Option>
           <Option name="pix_assume_fw_part_of_any">True</Option>
           <Option name="pix_check_duplicate_nat">False</Option>
@@ -19920,7 +19338,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emb_limit">0</Option>
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_floodguard">False</Option>
           <Option name="pix_fragguard">False</Option>
           <Option name="pix_generate_out_acl">False</Option>
@@ -19936,7 +19354,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
           <Option name="pix_optimize_default_nat">False</Option>
-          <Option name="pix_prolog_script"/>
+          <Option name="pix_prolog_script"></Option>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">True</Option>
           <Option name="pix_resetinbound">False</Option>
@@ -19944,10 +19362,10 @@ no sysopt nodnsalias outbound
           <Option name="pix_route_dnat">False</Option>
           <Option name="pix_set_host_name">False</Option>
           <Option name="pix_ssh_timeout">0</Option>
-          <Option name="pix_syslog_device_id_opt"/>
-          <Option name="pix_syslog_device_id_val"/>
-          <Option name="pix_syslog_facility"/>
-          <Option name="pix_syslog_host"/>
+          <Option name="pix_syslog_device_id_opt"></Option>
+          <Option name="pix_syslog_device_id_val"></Option>
+          <Option name="pix_syslog_facility"></Option>
+          <Option name="pix_syslog_host"></Option>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">0</Option>
           <Option name="pix_use_acl_remarks">False</Option>
@@ -19960,8 +19378,8 @@ no sysopt nodnsalias outbound
           <Option name="rpc_ss">0</Option>
           <Option name="rsh_fixup">2 514 0 nil 0</Option>
           <Option name="rtsp_fixup">2 554 0 nil 0</Option>
-          <Option name="scpArgs"/>
-          <Option name="script_env_path"/>
+          <Option name="scpArgs"></Option>
+          <Option name="script_env_path"></Option>
           <Option name="short_script">False</Option>
           <Option name="sip_fixup">2 5060 5060 nil 0</Option>
           <Option name="sip_hh">0</Option>
@@ -19973,11 +19391,11 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">2 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
@@ -20047,11 +19465,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id923624X27607" disabled="False" group="" log="False" position="1" action="Accept" direction="Inbound" comment="test rule using translated address in dst&#10;">
             <Src neg="False">
@@ -20070,11 +19486,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id923636X27607" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="test rule using translated address in dst&#10;">
             <Src neg="False">
@@ -20093,11 +19507,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id923648X27607" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="test rule using translated address in dst&#10;">
             <Src neg="False">
@@ -20116,11 +19528,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id923660X27607" disabled="False" group="" log="False" position="4" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -20139,11 +19549,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -20167,12 +19575,12 @@ no sysopt nodnsalias outbound
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -20181,8 +19589,8 @@ no sysopt nodnsalias outbound
           <Option name="dns_fixup">2 65535 0 nil 0</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
-          <Option name="filesystem"/>
-          <Option name="firewall_dir"/>
+          <Option name="filesystem"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ftp_fixup">2 21 0 strict 0</Option>
@@ -20199,9 +19607,9 @@ no sysopt nodnsalias outbound
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">2 389 389 nil 0</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="ip_options_eool_fixup">0 0 0 nil 0</Option>
           <Option name="ip_options_nop_fixup">1 0 0 nil 0</Option>
           <Option name="ip_options_rtralt">2 0 0 nil 0</Option>
@@ -20218,22 +19626,22 @@ no sysopt nodnsalias outbound
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modulate_state">False</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">False</Option>
           <Option name="pix_acl_basic">True</Option>
           <Option name="pix_acl_no_clear">False</Option>
           <Option name="pix_acl_substitution">False</Option>
-          <Option name="pix_acl_temp_addr"/>
+          <Option name="pix_acl_temp_addr"></Option>
           <Option name="pix_add_clear_statements">True</Option>
           <Option name="pix_assume_fw_part_of_any">True</Option>
           <Option name="pix_check_duplicate_nat">False</Option>
@@ -20245,7 +19653,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emb_limit">0</Option>
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_floodguard">False</Option>
           <Option name="pix_fragguard">False</Option>
           <Option name="pix_generate_out_acl">False</Option>
@@ -20261,7 +19669,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
           <Option name="pix_optimize_default_nat">False</Option>
-          <Option name="pix_prolog_script"/>
+          <Option name="pix_prolog_script"></Option>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">True</Option>
           <Option name="pix_resetinbound">False</Option>
@@ -20269,10 +19677,10 @@ no sysopt nodnsalias outbound
           <Option name="pix_route_dnat">False</Option>
           <Option name="pix_set_host_name">False</Option>
           <Option name="pix_ssh_timeout">0</Option>
-          <Option name="pix_syslog_device_id_opt"/>
-          <Option name="pix_syslog_device_id_val"/>
-          <Option name="pix_syslog_facility"/>
-          <Option name="pix_syslog_host"/>
+          <Option name="pix_syslog_device_id_opt"></Option>
+          <Option name="pix_syslog_device_id_val"></Option>
+          <Option name="pix_syslog_facility"></Option>
+          <Option name="pix_syslog_host"></Option>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">0</Option>
           <Option name="pix_use_acl_remarks">False</Option>
@@ -20285,8 +19693,8 @@ no sysopt nodnsalias outbound
           <Option name="rpc_ss">0</Option>
           <Option name="rsh_fixup">2 514 0 nil 0</Option>
           <Option name="rtsp_fixup">2 554 0 nil 0</Option>
-          <Option name="scpArgs"/>
-          <Option name="script_env_path"/>
+          <Option name="scpArgs"></Option>
+          <Option name="script_env_path"></Option>
           <Option name="short_script">False</Option>
           <Option name="sip_fixup">2 5060 5060 nil 0</Option>
           <Option name="sip_hh">0</Option>
@@ -20298,11 +19706,11 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">2 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
@@ -20372,11 +19780,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id923826X27607" disabled="False" group="" log="False" position="1" action="Accept" direction="Inbound" comment="test rule using translated address in dst&#10;">
             <Src neg="False">
@@ -20395,11 +19801,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id923838X27607" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="test rule using translated address in dst&#10;">
             <Src neg="False">
@@ -20418,11 +19822,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id923850X27607" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="test rule using translated address in dst&#10;">
             <Src neg="False">
@@ -20441,11 +19843,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id923862X27607" disabled="False" group="" log="False" position="4" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -20464,11 +19864,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -20492,12 +19890,12 @@ no sysopt nodnsalias outbound
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -20506,8 +19904,8 @@ no sysopt nodnsalias outbound
           <Option name="dns_fixup">2 65535 0 nil 0</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
-          <Option name="filesystem"/>
-          <Option name="firewall_dir"/>
+          <Option name="filesystem"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ftp_fixup">2 21 0 strict 0</Option>
@@ -20524,9 +19922,9 @@ no sysopt nodnsalias outbound
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">2 389 389 nil 0</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="ip_options_eool_fixup">0 0 0 nil 0</Option>
           <Option name="ip_options_nop_fixup">1 0 0 nil 0</Option>
           <Option name="ip_options_rtralt">2 0 0 nil 0</Option>
@@ -20543,22 +19941,22 @@ no sysopt nodnsalias outbound
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modulate_state">False</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">False</Option>
           <Option name="pix_acl_basic">True</Option>
           <Option name="pix_acl_no_clear">False</Option>
           <Option name="pix_acl_substitution">False</Option>
-          <Option name="pix_acl_temp_addr"/>
+          <Option name="pix_acl_temp_addr"></Option>
           <Option name="pix_add_clear_statements">True</Option>
           <Option name="pix_assume_fw_part_of_any">True</Option>
           <Option name="pix_check_duplicate_nat">False</Option>
@@ -20570,7 +19968,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emb_limit">0</Option>
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_floodguard">False</Option>
           <Option name="pix_fragguard">False</Option>
           <Option name="pix_generate_out_acl">False</Option>
@@ -20586,7 +19984,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
           <Option name="pix_optimize_default_nat">False</Option>
-          <Option name="pix_prolog_script"/>
+          <Option name="pix_prolog_script"></Option>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">True</Option>
           <Option name="pix_resetinbound">False</Option>
@@ -20594,10 +19992,10 @@ no sysopt nodnsalias outbound
           <Option name="pix_route_dnat">False</Option>
           <Option name="pix_set_host_name">False</Option>
           <Option name="pix_ssh_timeout">0</Option>
-          <Option name="pix_syslog_device_id_opt"/>
-          <Option name="pix_syslog_device_id_val"/>
-          <Option name="pix_syslog_facility"/>
-          <Option name="pix_syslog_host"/>
+          <Option name="pix_syslog_device_id_opt"></Option>
+          <Option name="pix_syslog_device_id_val"></Option>
+          <Option name="pix_syslog_facility"></Option>
+          <Option name="pix_syslog_host"></Option>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">0</Option>
           <Option name="pix_use_acl_remarks">False</Option>
@@ -20610,8 +20008,8 @@ no sysopt nodnsalias outbound
           <Option name="rpc_ss">0</Option>
           <Option name="rsh_fixup">2 514 0 nil 0</Option>
           <Option name="rtsp_fixup">2 554 0 nil 0</Option>
-          <Option name="scpArgs"/>
-          <Option name="script_env_path"/>
+          <Option name="scpArgs"></Option>
+          <Option name="script_env_path"></Option>
           <Option name="short_script">False</Option>
           <Option name="sip_fixup">2 5060 5060 nil 0</Option>
           <Option name="sip_hh">0</Option>
@@ -20623,11 +20021,11 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">2 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
@@ -21463,11 +20861,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id119026X32145" disabled="False" group="" log="False" position="1" action="Deny" direction="Both" comment="for #1942&#10;using custom service">
             <Src neg="False">
@@ -21487,11 +20883,9 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id118979X32145" disabled="False" group="" log="False" position="2" action="Deny" direction="Both" comment="for #1942&#10;using custom service">
             <Src neg="False">
@@ -21512,11 +20906,9 @@ no sysopt nodnsalias outbound
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id19907X26146" disabled="False" group="" log="False" position="3" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -21535,11 +20927,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -21564,12 +20954,12 @@ no sysopt nodnsalias outbound
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -21578,8 +20968,8 @@ no sysopt nodnsalias outbound
           <Option name="dns_fixup">2 65535 0 nil 0</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
-          <Option name="filesystem"/>
-          <Option name="firewall_dir"/>
+          <Option name="filesystem"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ftp_fixup">2 21 0 strict 0</Option>
@@ -21596,9 +20986,9 @@ no sysopt nodnsalias outbound
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">2 389 389 nil 0</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="ip_options_eool_fixup">0 0 0 nil 0</Option>
           <Option name="ip_options_nop_fixup">1 0 0 nil 0</Option>
           <Option name="ip_options_rtralt">2 0 0 nil 0</Option>
@@ -21615,22 +21005,22 @@ no sysopt nodnsalias outbound
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modulate_state">False</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">False</Option>
           <Option name="pix_acl_basic">True</Option>
           <Option name="pix_acl_no_clear">False</Option>
           <Option name="pix_acl_substitution">False</Option>
-          <Option name="pix_acl_temp_addr"/>
+          <Option name="pix_acl_temp_addr"></Option>
           <Option name="pix_add_clear_statements">True</Option>
           <Option name="pix_assume_fw_part_of_any">True</Option>
           <Option name="pix_check_duplicate_nat">False</Option>
@@ -21642,7 +21032,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emb_limit">0</Option>
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_floodguard">False</Option>
           <Option name="pix_fragguard">False</Option>
           <Option name="pix_generate_out_acl">False</Option>
@@ -21658,7 +21048,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
           <Option name="pix_optimize_default_nat">False</Option>
-          <Option name="pix_prolog_script"/>
+          <Option name="pix_prolog_script"></Option>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">True</Option>
           <Option name="pix_resetinbound">False</Option>
@@ -21666,10 +21056,10 @@ no sysopt nodnsalias outbound
           <Option name="pix_route_dnat">False</Option>
           <Option name="pix_set_host_name">False</Option>
           <Option name="pix_ssh_timeout">0</Option>
-          <Option name="pix_syslog_device_id_opt"/>
-          <Option name="pix_syslog_device_id_val"/>
-          <Option name="pix_syslog_facility"/>
-          <Option name="pix_syslog_host"/>
+          <Option name="pix_syslog_device_id_opt"></Option>
+          <Option name="pix_syslog_device_id_val"></Option>
+          <Option name="pix_syslog_facility"></Option>
+          <Option name="pix_syslog_host"></Option>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">0</Option>
           <Option name="pix_use_acl_remarks">False</Option>
@@ -21682,8 +21072,8 @@ no sysopt nodnsalias outbound
           <Option name="rpc_ss">0</Option>
           <Option name="rsh_fixup">2 514 0 nil 0</Option>
           <Option name="rtsp_fixup">2 554 0 nil 0</Option>
-          <Option name="scpArgs"/>
-          <Option name="script_env_path"/>
+          <Option name="scpArgs"></Option>
+          <Option name="script_env_path"></Option>
           <Option name="short_script">False</Option>
           <Option name="sip_fixup">2 5060 5060 nil 0</Option>
           <Option name="sip_hh">0</Option>
@@ -21695,11 +21085,11 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">2 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
@@ -22217,11 +21607,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -22246,12 +21634,12 @@ no sysopt nodnsalias outbound
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -22260,8 +21648,8 @@ no sysopt nodnsalias outbound
           <Option name="dns_fixup">2 65535 0 nil 0</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
-          <Option name="filesystem"/>
-          <Option name="firewall_dir"/>
+          <Option name="filesystem"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ftp_fixup">2 21 0 strict 0</Option>
@@ -22278,9 +21666,9 @@ no sysopt nodnsalias outbound
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">2 389 389 nil 0</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="ip_options_eool_fixup">0 0 0 nil 0</Option>
           <Option name="ip_options_nop_fixup">1 0 0 nil 0</Option>
           <Option name="ip_options_rtralt">2 0 0 nil 0</Option>
@@ -22297,22 +21685,22 @@ no sysopt nodnsalias outbound
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modulate_state">False</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">False</Option>
           <Option name="pix_acl_basic">True</Option>
           <Option name="pix_acl_no_clear">False</Option>
           <Option name="pix_acl_substitution">False</Option>
-          <Option name="pix_acl_temp_addr"/>
+          <Option name="pix_acl_temp_addr"></Option>
           <Option name="pix_add_clear_statements">True</Option>
           <Option name="pix_assume_fw_part_of_any">True</Option>
           <Option name="pix_check_duplicate_nat">False</Option>
@@ -22324,7 +21712,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emb_limit">0</Option>
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_floodguard">False</Option>
           <Option name="pix_fragguard">False</Option>
           <Option name="pix_generate_out_acl">False</Option>
@@ -22340,7 +21728,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
           <Option name="pix_optimize_default_nat">False</Option>
-          <Option name="pix_prolog_script"/>
+          <Option name="pix_prolog_script"></Option>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">True</Option>
           <Option name="pix_resetinbound">False</Option>
@@ -22348,10 +21736,10 @@ no sysopt nodnsalias outbound
           <Option name="pix_route_dnat">False</Option>
           <Option name="pix_set_host_name">False</Option>
           <Option name="pix_ssh_timeout">0</Option>
-          <Option name="pix_syslog_device_id_opt"/>
-          <Option name="pix_syslog_device_id_val"/>
-          <Option name="pix_syslog_facility"/>
-          <Option name="pix_syslog_host"/>
+          <Option name="pix_syslog_device_id_opt"></Option>
+          <Option name="pix_syslog_device_id_val"></Option>
+          <Option name="pix_syslog_facility"></Option>
+          <Option name="pix_syslog_host"></Option>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">0</Option>
           <Option name="pix_use_acl_remarks">False</Option>
@@ -22364,8 +21752,8 @@ no sysopt nodnsalias outbound
           <Option name="rpc_ss">0</Option>
           <Option name="rsh_fixup">2 514 0 nil 0</Option>
           <Option name="rtsp_fixup">2 554 0 nil 0</Option>
-          <Option name="scpArgs"/>
-          <Option name="script_env_path"/>
+          <Option name="scpArgs"></Option>
+          <Option name="script_env_path"></Option>
           <Option name="short_script">False</Option>
           <Option name="sip_fixup">2 5060 5060 nil 0</Option>
           <Option name="sip_hh">0</Option>
@@ -22377,11 +21765,11 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">2 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
@@ -22559,11 +21947,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -22588,12 +21974,12 @@ no sysopt nodnsalias outbound
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -22602,8 +21988,8 @@ no sysopt nodnsalias outbound
           <Option name="dns_fixup">2 65535 0 nil 0</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
-          <Option name="filesystem"/>
-          <Option name="firewall_dir"/>
+          <Option name="filesystem"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ftp_fixup">2 21 0 strict 0</Option>
@@ -22620,9 +22006,9 @@ no sysopt nodnsalias outbound
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">2 389 389 nil 0</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="ip_options_eool_fixup">0 0 0 nil 0</Option>
           <Option name="ip_options_nop_fixup">1 0 0 nil 0</Option>
           <Option name="ip_options_rtralt">2 0 0 nil 0</Option>
@@ -22639,22 +22025,22 @@ no sysopt nodnsalias outbound
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modulate_state">False</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">False</Option>
           <Option name="pix_acl_basic">True</Option>
           <Option name="pix_acl_no_clear">False</Option>
           <Option name="pix_acl_substitution">False</Option>
-          <Option name="pix_acl_temp_addr"/>
+          <Option name="pix_acl_temp_addr"></Option>
           <Option name="pix_add_clear_statements">True</Option>
           <Option name="pix_assume_fw_part_of_any">True</Option>
           <Option name="pix_check_duplicate_nat">False</Option>
@@ -22666,7 +22052,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emb_limit">0</Option>
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_floodguard">False</Option>
           <Option name="pix_fragguard">False</Option>
           <Option name="pix_generate_out_acl">False</Option>
@@ -22682,7 +22068,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
           <Option name="pix_optimize_default_nat">False</Option>
-          <Option name="pix_prolog_script"/>
+          <Option name="pix_prolog_script"></Option>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">True</Option>
           <Option name="pix_resetinbound">False</Option>
@@ -22690,10 +22076,10 @@ no sysopt nodnsalias outbound
           <Option name="pix_route_dnat">False</Option>
           <Option name="pix_set_host_name">False</Option>
           <Option name="pix_ssh_timeout">0</Option>
-          <Option name="pix_syslog_device_id_opt"/>
-          <Option name="pix_syslog_device_id_val"/>
-          <Option name="pix_syslog_facility"/>
-          <Option name="pix_syslog_host"/>
+          <Option name="pix_syslog_device_id_opt"></Option>
+          <Option name="pix_syslog_device_id_val"></Option>
+          <Option name="pix_syslog_facility"></Option>
+          <Option name="pix_syslog_host"></Option>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">0</Option>
           <Option name="pix_use_acl_remarks">False</Option>
@@ -22706,8 +22092,8 @@ no sysopt nodnsalias outbound
           <Option name="rpc_ss">0</Option>
           <Option name="rsh_fixup">2 514 0 nil 0</Option>
           <Option name="rtsp_fixup">2 554 0 nil 0</Option>
-          <Option name="scpArgs"/>
-          <Option name="script_env_path"/>
+          <Option name="scpArgs"></Option>
+          <Option name="script_env_path"></Option>
           <Option name="short_script">False</Option>
           <Option name="sip_fixup">2 5060 5060 nil 0</Option>
           <Option name="sip_hh">0</Option>
@@ -22719,11 +22105,11 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">2 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
@@ -22800,8 +22186,8 @@ no sysopt nodnsalias outbound
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
         <FirewallOptions>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
           <Option name="conn_hh">0</Option>
           <Option name="conn_mm">0</Option>
@@ -22809,8 +22195,8 @@ no sysopt nodnsalias outbound
           <Option name="ctiqbe_fixup">2 2748 0 nil 0</Option>
           <Option name="dns_fixup">2 65535 0 nil 0</Option>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
-          <Option name="filesystem"/>
-          <Option name="firewall_dir"/>
+          <Option name="filesystem"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="ftp_fixup">2 21 0 strict 0</Option>
           <Option name="h323_h225_fixup">2 1720 1720 nil 0</Option>
           <Option name="h323_hh">0</Option>
@@ -22829,13 +22215,13 @@ no sysopt nodnsalias outbound
           <Option name="ip_options_rtralt_fixup">2 0 0 nil 0</Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pix_acl_basic">True</Option>
           <Option name="pix_acl_no_clear">False</Option>
           <Option name="pix_acl_substitution">False</Option>
-          <Option name="pix_acl_temp_addr"/>
+          <Option name="pix_acl_temp_addr"></Option>
           <Option name="pix_add_clear_statements">true</Option>
           <Option name="pix_assume_fw_part_of_any">True</Option>
           <Option name="pix_check_duplicate_nat">False</Option>
@@ -22847,7 +22233,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emb_limit">0</Option>
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_floodguard">True</Option>
           <Option name="pix_fragguard">False</Option>
           <Option name="pix_generate_out_acl">False</Option>
@@ -22862,7 +22248,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
           <Option name="pix_optimize_default_nat">False</Option>
-          <Option name="pix_prolog_script"/>
+          <Option name="pix_prolog_script"></Option>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">False</Option>
           <Option name="pix_resetinbound">False</Option>
@@ -22872,11 +22258,11 @@ no sysopt nodnsalias outbound
           <Option name="pix_rule_syslog_settings">false</Option>
           <Option name="pix_security_fragguard_supported">true</Option>
           <Option name="pix_ssh_timeout">0</Option>
-          <Option name="pix_syslog_device_id_opt"/>
+          <Option name="pix_syslog_device_id_opt"></Option>
           <Option name="pix_syslog_device_id_supported">false</Option>
-          <Option name="pix_syslog_device_id_val"/>
-          <Option name="pix_syslog_facility"/>
-          <Option name="pix_syslog_host"/>
+          <Option name="pix_syslog_device_id_val"></Option>
+          <Option name="pix_syslog_facility"></Option>
+          <Option name="pix_syslog_host"></Option>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">0</Option>
           <Option name="pix_use_acl_remarks">True</Option>
@@ -22887,7 +22273,7 @@ no sysopt nodnsalias outbound
           <Option name="rpc_ss">0</Option>
           <Option name="rsh_fixup">2 514 0 nil 0</Option>
           <Option name="rtsp_fixup">2 554 0 nil 0</Option>
-          <Option name="scpArgs"/>
+          <Option name="scpArgs"></Option>
           <Option name="short_script">False</Option>
           <Option name="sip_fixup">2 5060 5060 nil 0</Option>
           <Option name="sip_hh">0</Option>
@@ -22900,7 +22286,7 @@ no sysopt nodnsalias outbound
           <Option name="skinny_fixup">2 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
           <Option name="uauth_abs">False</Option>
           <Option name="uauth_hh">0</Option>
@@ -22939,11 +22325,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -23096,7 +22480,7 @@ no sysopt nodnsalias outbound
             </ItfOutb>
             <NATRuleOptions>
               <Option name="color">#8BC065</Option>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
           <NATRule id="id626114X21763" disabled="False" group="" position="4" action="Translate" comment="">
@@ -23126,7 +22510,7 @@ no sysopt nodnsalias outbound
             </ItfOutb>
             <NATRuleOptions>
               <Option name="color">#8BC065</Option>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
           <NATRule id="id36895X21071" disabled="False" group="" position="5" action="Translate" comment="">
@@ -23277,17 +22661,17 @@ no sysopt nodnsalias outbound
           <Option name="action_on_reject">ICMP net unreachable</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="cmdline">-v</Option>
-          <Option name="compiler"/>
+          <Option name="compiler"></Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="firewall_dir"/>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
-          <Option name="id"/>
+          <Option name="id"></Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/second</Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_accept_redirects">0</Option>
@@ -23326,7 +22710,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_conn_mm">0</Option>
           <Option name="pix_conn_ss">0</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_h323_abs">True</Option>
           <Option name="pix_h323_hh">0</Option>
           <Option name="pix_h323_inact">False</Option>
@@ -23334,7 +22718,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_h323_ss">0</Option>
           <Option name="pix_include_comments">True</Option>
           <Option name="pix_ip_address">False</Option>
-          <Option name="pix_prolog_script"/>
+          <Option name="pix_prolog_script"></Option>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">True</Option>
           <Option name="pix_rpc_abs">True</Option>
@@ -23372,10 +22756,10 @@ no sysopt nodnsalias outbound
           <Option name="pix_xlate_ss">0</Option>
           <Option name="platform">iptables</Option>
           <Option name="proxy_arp">True</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="use_ip_tool">True</Option>
           <Option name="use_numeric_log_levels">False</Option>
         </FirewallOptions>
@@ -23429,11 +22813,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id59803X13930" disabled="False" group="" log="False" position="1" action="Accept" direction="Inbound" comment="need this rule to generate at least one object group&#10;">
             <Src neg="False">
@@ -23452,9 +22834,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id60455X13930" disabled="False" group="" log="True" position="2" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -23473,16 +22854,14 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"/>
-              <Option name="log_prefix"/>
+              <Option name="log_limit_suffix"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -23510,12 +22889,12 @@ no sysopt nodnsalias outbound
           <Option name="accept_established">False</Option>
           <Option name="accept_new_tcp_with_no_syn">False</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">True</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="cmdline">-v</Option>
-          <Option name="compiler"/>
+          <Option name="compiler"></Option>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -23524,8 +22903,8 @@ no sysopt nodnsalias outbound
           <Option name="dns_fixup">2 65535 0 nil 0</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
-          <Option name="filesystem"/>
-          <Option name="firewall_dir"/>
+          <Option name="filesystem"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ftp_fixup">0 21 0 strict 0</Option>
@@ -23542,9 +22921,9 @@ no sysopt nodnsalias outbound
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">0 389 389 nil 0</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="ip_options_eool_fixup">2 0 0 nil 0</Option>
           <Option name="ip_options_nop_fixup">2 0 0 nil 0</Option>
           <Option name="ip_options_rtralt_fixup">2 0 0 nil 0</Option>
@@ -23560,12 +22939,12 @@ no sysopt nodnsalias outbound
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modulate_state">False</Option>
           <Option name="no_iochains_for_any">False</Option>
@@ -23574,7 +22953,7 @@ no sysopt nodnsalias outbound
           <Option name="openbsd_ip_forward">1</Option>
           <Option name="openbsd_ip_redirect">0</Option>
           <Option name="openbsd_ip_sourceroute">0</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">False</Option>
           <Option name="pix_acl_basic">False</Option>
           <Option name="pix_acl_no_clear">False</Option>
@@ -23598,7 +22977,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
           <Option name="pix_enable_snmp_traps">True</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_floodguard">False</Option>
           <Option name="pix_fragguard">True</Option>
           <Option name="pix_generate_out_acl">False</Option>
@@ -23620,9 +22999,9 @@ no sysopt nodnsalias outbound
           <Option name="pix_nodnsalias_outbound">True</Option>
           <Option name="pix_ntp1">192.168.1.20</Option>
           <Option name="pix_ntp1_pref">True</Option>
-          <Option name="pix_ntp2"/>
+          <Option name="pix_ntp2"></Option>
           <Option name="pix_ntp2_pref">False</Option>
-          <Option name="pix_ntp3"/>
+          <Option name="pix_ntp3"></Option>
           <Option name="pix_ntp3_pref">False</Option>
           <Option name="pix_optimize_default_nat">True</Option>
           <Option name="pix_prolog_script">	
@@ -23655,8 +23034,8 @@ no sysopt nodnsalias outbound
           <Option name="pix_snmp_server1">192.168.1.20</Option>
           <Option name="pix_snmp_server2">192.168.1.22</Option>
           <Option name="pix_ssh_timeout">5</Option>
-          <Option name="pix_syslog_device_id_opt"/>
-          <Option name="pix_syslog_device_id_val"/>
+          <Option name="pix_syslog_device_id_opt"></Option>
+          <Option name="pix_syslog_device_id_val"></Option>
           <Option name="pix_syslog_facility">16</Option>
           <Option name="pix_syslog_host">192.168.1.30</Option>
           <Option name="pix_syslog_level">error</Option>
@@ -23693,8 +23072,8 @@ no sysopt nodnsalias outbound
           <Option name="rpc_ss">0</Option>
           <Option name="rsh_fixup">0 514 0 nil 0</Option>
           <Option name="rtsp_fixup">0 554 0 nil 0</Option>
-          <Option name="scpArgs"/>
-          <Option name="script_env_path"/>
+          <Option name="scpArgs"></Option>
+          <Option name="script_env_path"></Option>
           <Option name="short_script">False</Option>
           <Option name="sip_fixup">0 5060 5060 nil 0</Option>
           <Option name="sip_hh">0</Option>
@@ -23706,11 +23085,11 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">0 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">0 25 25 nil 0</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="sqlnet_fixup">0 1521 1521 nil 0</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
@@ -24106,11 +23485,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id36903X447" disabled="True" group="" log="True" position="1" action="Deny" direction="Inbound" comment="">
             <Src neg="False">
@@ -24125,13 +23502,10 @@ no sysopt nodnsalias outbound
             <Itf neg="False">
               <ObjectRef ref="id36858X447"/>
             </Itf>
-            
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id36928X447" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -24150,9 +23524,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id36956X447" disabled="False" group="" log="True" position="3" action="Accept" direction="Outbound" comment="anti-spoofing rule">
             <Src neg="False">
@@ -24172,9 +23545,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id36985X447" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -24189,11 +23561,9 @@ no sysopt nodnsalias outbound
             <Itf neg="False">
               <ObjectRef ref="id36863X447"/>
             </Itf>
-            
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id37010X447" disabled="False" group="" log="False" position="5" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -24209,11 +23579,9 @@ no sysopt nodnsalias outbound
             <Itf neg="False">
               <ObjectRef ref="id36863X447"/>
             </Itf>
-            
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id37036X447" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="">
             <Src neg="False">
@@ -24232,11 +23600,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id37064X447" disabled="True" group="" log="True" position="7" action="Deny" direction="Both" comment="this rule, if enabled, shades&#10;some rule below because&#10;of service &quot;any ICMP&quot;">
             <Src neg="False">
@@ -24257,15 +23623,13 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"/>
-              <Option name="log_prefix"/>
+              <Option name="log_limit_suffix"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id37094X447" disabled="False" group="" log="False" position="8" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -24284,9 +23648,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id37122X447" disabled="False" group="" log="False" position="9" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -24305,14 +23668,12 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id37150X447" disabled="False" group="" log="True" position="10" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -24332,15 +23693,13 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"/>
-              <Option name="log_prefix"/>
+              <Option name="log_limit_suffix"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id37179X447" disabled="True" group="" log="False" position="11" action="Deny" direction="Both" comment="shades rule #8 below">
             <Src neg="False">
@@ -24359,11 +23718,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id37207X447" disabled="False" group="" log="False" position="12" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -24384,14 +23741,12 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id37237X447" disabled="False" group="" log="False" position="13" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -24410,9 +23765,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id37265X447" disabled="False" group="" log="False" position="14" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -24431,9 +23785,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id37293X447" disabled="False" group="" log="False" position="15" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -24453,9 +23806,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id37322X447" disabled="False" group="" log="False" position="16" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -24475,14 +23827,12 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id37351X447" disabled="False" group="" log="False" position="17" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -24502,14 +23852,12 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id37380X447" disabled="False" group="" log="False" position="18" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -24529,14 +23877,12 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id37409X447" disabled="False" group="" log="False" position="19" action="Accept" direction="Both" comment="objects hostA and hostB are&#10;redundant and should be removed by&#10; removeRedundantAddressesFromDst">
             <Src neg="False">
@@ -24557,14 +23903,12 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id37439X447" disabled="False" group="" log="False" position="20" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -24583,9 +23927,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id37467X447" disabled="True" group="" log="False" position="21" action="Accept" direction="Both" comment="rules 12 and 13 can be&#10;used to test shading">
             <Src neg="False">
@@ -24604,14 +23947,12 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id37495X447" disabled="True" group="" log="False" position="22" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -24630,14 +23971,12 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id37523X447" disabled="False" group="" log="True" position="23" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -24656,9 +23995,8 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id37551X447" disabled="False" group="" log="False" position="24" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -24678,14 +24016,12 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id37580X447" disabled="False" group="" log="True" position="25" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -24704,16 +24040,14 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"/>
-              <Option name="log_prefix"/>
+              <Option name="log_limit_suffix"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -24741,12 +24075,12 @@ no sysopt nodnsalias outbound
           <Option name="accept_established">False</Option>
           <Option name="accept_new_tcp_with_no_syn">False</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">True</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="cmdline">-v</Option>
-          <Option name="compiler"/>
+          <Option name="compiler"></Option>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -24755,7 +24089,7 @@ no sysopt nodnsalias outbound
           <Option name="dns_fixup">2 65535 0 nil 0</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
-          <Option name="firewall_dir"/>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ftp_fixup">0 21 0 strict 0</Option>
@@ -24772,9 +24106,9 @@ no sysopt nodnsalias outbound
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">0 389 389 nil 0</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/second</Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">0</Option>
@@ -24786,12 +24120,12 @@ no sysopt nodnsalias outbound
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modulate_state">False</Option>
           <Option name="no_iochains_for_any">False</Option>
@@ -24800,7 +24134,7 @@ no sysopt nodnsalias outbound
           <Option name="openbsd_ip_forward">1</Option>
           <Option name="openbsd_ip_redirect">0</Option>
           <Option name="openbsd_ip_sourceroute">0</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">False</Option>
           <Option name="pix_acl_basic">False</Option>
           <Option name="pix_acl_no_clear">False</Option>
@@ -24824,7 +24158,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
           <Option name="pix_enable_snmp_traps">True</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_floodguard">False</Option>
           <Option name="pix_fragguard">True</Option>
           <Option name="pix_h323_abs">True</Option>
@@ -24845,9 +24179,9 @@ no sysopt nodnsalias outbound
           <Option name="pix_nodnsalias_outbound">True</Option>
           <Option name="pix_ntp1">192.168.1.20</Option>
           <Option name="pix_ntp1_pref">True</Option>
-          <Option name="pix_ntp2"/>
+          <Option name="pix_ntp2"></Option>
           <Option name="pix_ntp2_pref">False</Option>
-          <Option name="pix_ntp3"/>
+          <Option name="pix_ntp3"></Option>
           <Option name="pix_ntp3_pref">False</Option>
           <Option name="pix_optimize_default_nat">True</Option>
           <Option name="pix_prolog_script">	
@@ -24915,7 +24249,7 @@ no sysopt nodnsalias outbound
           <Option name="rpc_ss">0</Option>
           <Option name="rsh_fixup">0 514 0 nil 0</Option>
           <Option name="rtsp_fixup">0 554 0 nil 0</Option>
-          <Option name="script_env_path"/>
+          <Option name="script_env_path"></Option>
           <Option name="sip_fixup">0 5060 5060 nil 0</Option>
           <Option name="sip_hh">0</Option>
           <Option name="sip_media_hh">0</Option>
@@ -24926,11 +24260,11 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">0 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">0 25 25 nil 0</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="sqlnet_fixup">0 1521 1521 nil 0</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
@@ -24970,11 +24304,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id113045X5474" disabled="False" group="" log="False" position="1" action="Deny" direction="Both" comment="">
             <Src neg="False">
@@ -24993,11 +24325,9 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -25022,11 +24352,11 @@ no sysopt nodnsalias outbound
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
         <FirewallOptions>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="conn_hh">0</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -25034,8 +24364,8 @@ no sysopt nodnsalias outbound
           <Option name="dns_fixup">0 65535 0 nil 0</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
-          <Option name="filesystem"/>
-          <Option name="firewall_dir"/>
+          <Option name="filesystem"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="ftp_fixup">0 21 0 strict 0</Option>
           <Option name="h323_h225_fixup">0 1720 1720 nil 0</Option>
           <Option name="h323_hh">0</Option>
@@ -25054,13 +24384,13 @@ no sysopt nodnsalias outbound
           <Option name="ip_options_rtralt_fixup">2 0 0 nil 0</Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
           <Option name="mgcp_fixup">0 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pix_acl_basic">False</Option>
           <Option name="pix_acl_no_clear">True</Option>
           <Option name="pix_acl_substitution">False</Option>
-          <Option name="pix_acl_temp_addr"/>
+          <Option name="pix_acl_temp_addr"></Option>
           <Option name="pix_add_clear_statements">False</Option>
           <Option name="pix_assume_fw_part_of_any">False</Option>
           <Option name="pix_check_duplicate_nat">False</Option>
@@ -25077,7 +24407,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emb_limit">0</Option>
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"/>
+          <Option name="pix_epilog_script"></Option>
           <Option name="pix_floodguard">False</Option>
           <Option name="pix_fragguard">False</Option>
           <Option name="pix_generate_out_acl">False</Option>
@@ -25098,7 +24428,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
           <Option name="pix_optimize_default_nat">False</Option>
-          <Option name="pix_prolog_script"/>
+          <Option name="pix_prolog_script"></Option>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">False</Option>
           <Option name="pix_resetinbound">False</Option>
@@ -25121,10 +24451,10 @@ no sysopt nodnsalias outbound
           <Option name="pix_sip_mm">30</Option>
           <Option name="pix_sip_ss">0</Option>
           <Option name="pix_ssh_timeout">5</Option>
-          <Option name="pix_syslog_device_id_opt"/>
-          <Option name="pix_syslog_device_id_val"/>
-          <Option name="pix_syslog_facility"/>
-          <Option name="pix_syslog_host"/>
+          <Option name="pix_syslog_device_id_opt"></Option>
+          <Option name="pix_syslog_device_id_val"></Option>
+          <Option name="pix_syslog_facility"></Option>
+          <Option name="pix_syslog_host"></Option>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">5</Option>
           <Option name="pix_uauth_abs">True</Option>
@@ -25150,7 +24480,7 @@ no sysopt nodnsalias outbound
           <Option name="rpc_ss">0</Option>
           <Option name="rsh_fixup">0 514 0 nil 0</Option>
           <Option name="rtsp_fixup">0 554 0 nil 0</Option>
-          <Option name="scpArgs"/>
+          <Option name="scpArgs"></Option>
           <Option name="short_script">True</Option>
           <Option name="sip_fixup">0 5060 5060 nil 0</Option>
           <Option name="sip_hh">0</Option>
@@ -25162,11 +24492,11 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">0 5060 0 nil 0</Option>
           <Option name="skinny_fixup">0 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">0 25 25 nil 0</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="sqlnet_fixup">0 1521 1521 nil 0</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="tftp_fixup">0 69 0 nil 0</Option>
           <Option name="uauth_abs">True</Option>
           <Option name="uauth_hh">0</Option>
diff --git a/test/procurve_acl/objects-for-regression-tests.fwb b/test/procurve_acl/objects-for-regression-tests.fwb
index aaa8f6345..0dfb5d2d3 100644
--- a/test/procurve_acl/objects-for-regression-tests.fwb
+++ b/test/procurve_acl/objects-for-regression-tests.fwb
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
-<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="20" lastModified="1273676680" id="root">
+<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="21" lastModified="1273676680" id="root">
   <Library id="syslib000" color="#d4f8ff" name="Standard" comment="Standard objects" ro="True">
     <AnyNetwork id="sysid0" name="Any" comment="Any Network" ro="False" address="0.0.0.0" netmask="0.0.0.0"/>
     <AnyIPService id="sysid1" protocol_num="0" name="Any" comment="Any IP Service" ro="False"/>
@@ -51,9 +51,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -69,9 +69,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -100,17 +100,17 @@
     </ObjectGroup>
     <ServiceGroup id="stdid05" name="Services" comment="" ro="False">
       <CustomService id="stdid14_1" name="ESTABLISHED" comment="This service matches all packets which are part of network connections established through the firewall, or connections 'related' to those established through the firewall. Term 'established' refers to the state tracking mechanism which exists inside iptables and other stateful firewalls and does not mean any particular combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful inspection module made appropriate record in the state table. Usually stateful firewalls keep track of network connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' describes packet belonging to a separate network connection, related to the session firewall is keeping track of. One example is FTP command and FTP data sessions." ro="False" protocol="any" address_family="ipv4">
-        <CustomServiceCommand platform="Undefined"/>
+        <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
         <CustomServiceCommand platform="iosacl">established</CustomServiceCommand>
-        <CustomServiceCommand platform="ipfilter"/>
+        <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
         <CustomServiceCommand platform="ipfw">established</CustomServiceCommand>
         <CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
         <CustomServiceCommand platform="procurve_acl">established</CustomServiceCommand>
       </CustomService>
       <CustomService id="stdid14_2" name="ESTABLISHED ipv6" comment="This service matches all packets which are part of network connections established through the firewall, or connections 'related' to those established through the firewall. Term 'established' refers to the state tracking mechanism which exists inside iptables and other stateful firewalls and does not mean any particular combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful inspection module made appropriate record in the state table. Usually stateful firewalls keep track of network connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' describes packet belonging to a separate network connection, related to the session firewall is keeping track of. One example is FTP command and FTP data sessions." ro="False" protocol="any" address_family="ipv6">
-        <CustomServiceCommand platform="Undefined"/>
+        <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
         <CustomServiceCommand platform="iosacl">established</CustomServiceCommand>
-        <CustomServiceCommand platform="ipfilter"/>
+        <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
         <CustomServiceCommand platform="ipfw">established</CustomServiceCommand>
         <CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
         <CustomServiceCommand platform="procurve_acl">established</CustomServiceCommand>
@@ -352,54 +352,54 @@
       </ServiceGroup>
       <ServiceGroup id="stdid13" name="Custom" comment="" ro="False">
         <CustomService id="id3B64EEA8" name="rpc" comment="works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"/>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfilter"/>
-          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m record_rpc</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
         <CustomService id="id3B64EF4E" name="irc-conn" comment="IRC connection tracker, supports DCC.&#10;Works on iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/&#10;" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"/>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfilter"/>
-          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m irc</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
         <CustomService id="id3B64EF50" name="psd" comment="Port scan detector, works only on iptables and  requires patch-o-matic &#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"/>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfilter"/>
-          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m psd --psd-weight-threshold 5 --psd-delay-threshold 10000</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
         <CustomService id="id3B64EF52" name="string" comment="Matches a string in a whole packet, works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"/>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfilter"/>
-          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m string --string test_pattern</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
         <CustomService id="id3B64EF54" name="talk" comment="Talk protocol support. Works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"/>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfilter"/>
-          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m talk</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
       </ServiceGroup>
       <ServiceGroup id="stdid19" name="TagServices" comment="" ro="False"/>
@@ -566,34 +566,34 @@
       <ServiceGroup id="id4511637123682" name="UDP" comment="" ro="False"/>
       <ServiceGroup id="id4511637223682" name="Custom" comment="" ro="False">
         <CustomService id="id4226X64279" name="dscp af11" comment="" ro="False" protocol="tcp" address_family="ipv4">
-          <CustomServiceCommand platform="fwsm"/>
+          <CustomServiceCommand platform="fwsm"></CustomServiceCommand>
           <CustomServiceCommand platform="iosacl">dscp af11</CustomServiceCommand>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfw"/>
-          <CustomServiceCommand platform="iptables"/>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
+          <CustomServiceCommand platform="iptables"></CustomServiceCommand>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
         <CustomService id="id8888X64279" name="esp dscp af12" comment="" ro="False" protocol="50" address_family="ipv4">
-          <CustomServiceCommand platform="fwsm"/>
+          <CustomServiceCommand platform="fwsm"></CustomServiceCommand>
           <CustomServiceCommand platform="iosacl">dscp af12</CustomServiceCommand>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfw"/>
-          <CustomServiceCommand platform="iptables"/>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
+          <CustomServiceCommand platform="iptables"></CustomServiceCommand>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
         <CustomService id="id26068X65694" name="esp dscp af11 ipv6" comment="" ro="False" protocol="50" address_family="ipv6">
-          <CustomServiceCommand platform="fwsm"/>
+          <CustomServiceCommand platform="fwsm"></CustomServiceCommand>
           <CustomServiceCommand platform="iosacl">dscp af11</CustomServiceCommand>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfw"/>
-          <CustomServiceCommand platform="iptables"/>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
+          <CustomServiceCommand platform="iptables"></CustomServiceCommand>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
       </ServiceGroup>
       <ServiceGroup id="id4511637323682" name="TagServices" comment="" ro="False"/>
@@ -605,7 +605,7 @@
           <RuleSetOptions/>
         </NAT>
         <Policy id="id46412B5526577" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id464154BB29061" disabled="False" log="True" position="0" action="Deny" direction="Inbound" comment="anti-spoofing">
+          <PolicyRule id="id464154BB29061" disabled="False" group="" log="True" position="0" action="Deny" direction="Inbound" comment="anti-spoofing">
             <Src neg="False">
               <ObjectRef ref="id46412C4226611"/>
             </Src>
@@ -622,13 +622,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id46412C3326611" disabled="False" log="False" position="1" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id46412C3326611" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -646,13 +644,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id46415A0129061" disabled="False" log="False" position="2" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id46415A0129061" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -671,11 +667,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id25349X82668" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -695,13 +689,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4641356226611" disabled="False" log="False" position="4" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4641356226611" disabled="False" group="" log="False" position="4" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -719,13 +711,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4641359926611" disabled="False" log="False" position="5" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4641359926611" disabled="False" group="" log="False" position="5" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -743,13 +733,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id46412F0326611" disabled="False" log="False" position="6" action="Accept" direction="Inbound" comment="">
+          <PolicyRule id="id46412F0326611" disabled="False" group="" log="False" position="6" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -767,13 +755,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4641357426611" disabled="False" log="False" position="7" action="Accept" direction="Inbound" comment="">
+          <PolicyRule id="id4641357426611" disabled="False" group="" log="False" position="7" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -791,13 +777,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4641358626611" disabled="False" log="False" position="8" action="Accept" direction="Inbound" comment="">
+          <PolicyRule id="id4641358626611" disabled="False" group="" log="False" position="8" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -815,13 +799,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4641456D29061" disabled="False" log="False" position="9" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4641456D29061" disabled="False" group="" log="False" position="9" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4641456929061"/>
             </Src>
@@ -839,13 +821,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4641457E29061" disabled="False" log="False" position="10" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4641457E29061" disabled="False" group="" log="False" position="10" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4641456929061"/>
             </Src>
@@ -863,13 +843,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4641458F29061" disabled="False" log="False" position="11" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4641458F29061" disabled="False" group="" log="False" position="11" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4641456929061"/>
             </Src>
@@ -887,13 +865,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id464147C929061" disabled="False" log="False" position="12" action="Accept" direction="Both" comment="interface ethernet1 has address on network 10.10.10.0/24,&#10;therefore net-10.10.10 is behind the router and we do&#10;not need to put rules 12-18 in outbound acl of eth0">
+          <PolicyRule id="id464147C929061" disabled="False" group="" log="False" position="12" action="Accept" direction="Both" comment="interface ethernet1 has address on network 10.10.10.0/24,&#10;therefore net-10.10.10 is behind the router and we do&#10;not need to put rules 12-18 in outbound acl of eth0">
             <Src neg="False">
               <ObjectRef ref="id4641456629061"/>
             </Src>
@@ -911,13 +887,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id46414A3E29061" disabled="False" log="False" position="13" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id46414A3E29061" disabled="False" group="" log="False" position="13" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4641456629061"/>
             </Src>
@@ -935,13 +909,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id46414A4F29061" disabled="False" log="False" position="14" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id46414A4F29061" disabled="False" group="" log="False" position="14" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4641456629061"/>
             </Src>
@@ -959,13 +931,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id46414A6029061" disabled="False" log="False" position="15" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id46414A6029061" disabled="False" group="" log="False" position="15" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4641456629061"/>
             </Src>
@@ -983,13 +953,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id46414CEB29061" disabled="False" log="False" position="16" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id46414CEB29061" disabled="False" group="" log="False" position="16" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4641456629061"/>
             </Src>
@@ -1007,13 +975,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4641521829061" disabled="False" log="False" position="17" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4641521829061" disabled="False" group="" log="False" position="17" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4641456629061"/>
             </Src>
@@ -1031,13 +997,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id46415F6729061" disabled="False" log="False" position="18" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id46415F6729061" disabled="False" group="" log="False" position="18" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4641456629061"/>
             </Src>
@@ -1055,11 +1019,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id5377X64279" disabled="False" group="" log="False" position="19" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -1079,11 +1041,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#7694C0</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id8889X64279" disabled="False" group="" log="False" position="20" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -1103,11 +1063,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#7694C0</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id5646X48212" disabled="False" group="" log="False" position="21" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -1126,11 +1084,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id5801X48212" disabled="False" group="" log="False" position="22" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
@@ -1150,13 +1106,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id46412C2726611" disabled="False" log="True" position="23" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id46412C2726611" disabled="False" group="" log="True" position="23" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1173,11 +1127,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -1246,10 +1198,10 @@
           <Option name="accept_established">true</Option>
           <Option name="accept_new_tcp_with_no_syn">true</Option>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
-          <Option name="compiler"/>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">true</Option>
           <Option name="eliminate_duplicates">true</Option>
           <Option name="filesystem">/etc</Option>
@@ -1278,8 +1230,8 @@
           <Option name="iosacl_logging_trap_level">3</Option>
           <Option name="iosacl_prolog_script">! This is prolog</Option>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"/>
-          <Option name="iosacl_syslog_host"/>
+          <Option name="iosacl_syslog_facility"></Option>
+          <Option name="iosacl_syslog_host"></Option>
           <Option name="iosacl_use_acl_remarks">False</Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
           <Option name="limit_value">0</Option>
@@ -1294,7 +1246,7 @@
           <Option name="mgmt_addr">10.10.11.10</Option>
           <Option name="mgmt_ssh">True</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">false</Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
@@ -1316,10 +1268,10 @@
           <Option name="procurve_acl_acl_basic">True</Option>
           <Option name="procurve_acl_acl_no_clear">False</Option>
           <Option name="procurve_acl_acl_substitution">False</Option>
-          <Option name="procurve_acl_acl_temp_addr"/>
+          <Option name="procurve_acl_acl_temp_addr"></Option>
           <Option name="procurve_acl_add_clear_statements">true</Option>
           <Option name="procurve_acl_assume_fw_part_of_any">true</Option>
-          <Option name="procurve_acl_epilog_script"/>
+          <Option name="procurve_acl_epilog_script"></Option>
           <Option name="procurve_acl_generate_logging_commands">False</Option>
           <Option name="procurve_acl_include_comments">true</Option>
           <Option name="procurve_acl_logging_buffered">False</Option>
@@ -1328,14 +1280,14 @@
           <Option name="procurve_acl_logging_console_level">2</Option>
           <Option name="procurve_acl_logging_timestamp">False</Option>
           <Option name="procurve_acl_logging_trap_level">2</Option>
-          <Option name="procurve_acl_prolog_script"/>
-          <Option name="procurve_acl_syslog_facility"/>
-          <Option name="procurve_acl_syslog_host"/>
+          <Option name="procurve_acl_prolog_script"></Option>
+          <Option name="procurve_acl_syslog_facility"></Option>
+          <Option name="procurve_acl_syslog_host"></Option>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
-          <Option name="scpArgs"/>
+          <Option name="scpArgs"></Option>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="use_scp">False</Option>
           <Option name="verify_interfaces">true</Option>
@@ -1363,11 +1315,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id28332X65694" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -1387,11 +1337,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -1413,13 +1361,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id19137X65694" disabled="False" log="False" position="1" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id19137X65694" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id19151X65694"/>
             </Src>
@@ -1436,13 +1382,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id19165X65694" disabled="False" log="True" position="2" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id19165X65694" disabled="False" group="" log="True" position="2" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id19179X65694"/>
             </Src>
@@ -1459,11 +1403,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id19194X65694" disabled="False" group="" log="True" position="3" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -1482,11 +1424,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id19226X65694" disabled="False" group="" log="True" position="4" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -1505,11 +1445,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id19260X65694" disabled="False" group="" log="True" position="5" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -1528,11 +1466,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id19288X65694" disabled="False" group="" log="True" position="6" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -1551,13 +1487,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id19316X65694" disabled="False" log="True" position="7" action="Accept" direction="Inbound" comment="">
+          <PolicyRule id="id19316X65694" disabled="False" group="" log="True" position="7" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1574,13 +1508,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id19344X65694" disabled="False" log="True" position="8" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id19344X65694" disabled="False" group="" log="True" position="8" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id19068X65694"/>
             </Src>
@@ -1597,13 +1529,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id19372X65694" disabled="False" log="True" position="9" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id19372X65694" disabled="False" group="" log="True" position="9" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id19208X65694"/>
             </Src>
@@ -1620,13 +1550,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id19400X65694" disabled="False" log="True" position="10" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id19400X65694" disabled="False" group="" log="True" position="10" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id19240X65694"/>
             </Src>
@@ -1643,11 +1571,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id24941X65694" disabled="False" group="" log="False" position="11" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -1667,11 +1593,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id7994X97727" disabled="False" group="" log="False" position="12" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -1690,11 +1614,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id9240X97727" disabled="False" group="" log="False" position="13" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -1717,11 +1639,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -1741,34 +1661,34 @@
         <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
-          <Option name="action_on_reject"/>
-          <Option name="activationCmd"/>
+          <Option name="action_on_reject"></Option>
+          <Option name="activationCmd"></Option>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">True</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="classify_mark_terminating">False</Option>
           <Option name="cmdline">-xt</Option>
-          <Option name="compiler"/>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="eliminate_duplicates">true</Option>
           <Option name="enable_ipv6">True</Option>
-          <Option name="epilog_script"/>
+          <Option name="epilog_script"></Option>
           <Option name="fallback_log">False</Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="freebsd_ip_forward">1</Option>
-          <Option name="freebsd_ip_redirect"/>
-          <Option name="freebsd_ip_sourceroute"/>
+          <Option name="freebsd_ip_redirect"></Option>
+          <Option name="freebsd_ip_sourceroute"></Option>
           <Option name="freebsd_ipv6_forward">1</Option>
-          <Option name="freebsd_path_ipf"/>
-          <Option name="freebsd_path_ipfw"/>
-          <Option name="freebsd_path_ipnat"/>
-          <Option name="freebsd_path_sysctl"/>
+          <Option name="freebsd_path_ipf"></Option>
+          <Option name="freebsd_path_ipfw"></Option>
+          <Option name="freebsd_path_ipnat"></Option>
+          <Option name="freebsd_path_sysctl"></Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="in_out_code">True</Option>
           <Option name="iosacl_acl_basic">False</Option>
@@ -1777,7 +1697,7 @@
           <Option name="iosacl_acl_temp_addr">fe80::21d:9ff:aaaa:bbbb</Option>
           <Option name="iosacl_add_clear_statements">true</Option>
           <Option name="iosacl_assume_fw_part_of_any">true</Option>
-          <Option name="iosacl_epilog_script"/>
+          <Option name="iosacl_epilog_script"></Option>
           <Option name="iosacl_generate_logging_commands">False</Option>
           <Option name="iosacl_include_comments">True</Option>
           <Option name="iosacl_logging_buffered">False</Option>
@@ -1786,13 +1706,13 @@
           <Option name="iosacl_logging_console_level">0</Option>
           <Option name="iosacl_logging_timestamp">False</Option>
           <Option name="iosacl_logging_trap_level">0</Option>
-          <Option name="iosacl_prolog_script"/>
+          <Option name="iosacl_prolog_script"></Option>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"/>
-          <Option name="iosacl_syslog_host"/>
-          <Option name="ipt_mangle_only_rulesets"/>
+          <Option name="iosacl_syslog_facility"></Option>
+          <Option name="iosacl_syslog_host"></Option>
+          <Option name="ipt_mangle_only_rulesets"></Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
-          <Option name="limit_suffix"/>
+          <Option name="limit_suffix"></Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">1</Option>
           <Option name="load_modules">True</Option>
@@ -1807,18 +1727,18 @@
           <Option name="loopback_interface">lo0</Option>
           <Option name="macosx_ip_forward">1</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modulate_state">False</Option>
           <Option name="no_ipv6_default_policy">False</Option>
-          <Option name="openbsd_ip_directed_broadcast"/>
+          <Option name="openbsd_ip_directed_broadcast"></Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="openbsd_ip_redirect"/>
-          <Option name="openbsd_ip_sourceroute"/>
+          <Option name="openbsd_ip_redirect"></Option>
+          <Option name="openbsd_ip_sourceroute"></Option>
           <Option name="openbsd_ipv6_forward">1</Option>
-          <Option name="openbsd_path_pfctl"/>
-          <Option name="openbsd_path_sysctl"/>
-          <Option name="output_file"/>
+          <Option name="openbsd_path_pfctl"></Option>
+          <Option name="openbsd_path_sysctl"></Option>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">False</Option>
           <Option name="pf_adaptive_end">0</Option>
           <Option name="pf_adaptive_start">0</Option>
@@ -1837,7 +1757,7 @@
           <Option name="pf_limit_states">10000</Option>
           <Option name="pf_limit_table_entries">0</Option>
           <Option name="pf_limit_tables">0</Option>
-          <Option name="pf_optimization"/>
+          <Option name="pf_optimization"></Option>
           <Option name="pf_other_first">0</Option>
           <Option name="pf_other_multiple">0</Option>
           <Option name="pf_other_single">0</Option>
@@ -1889,12 +1809,12 @@
           <Option name="pix_syslog_device_id_supported">false</Option>
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="prolog_place">fw_file</Option>
-          <Option name="prolog_script"/>
+          <Option name="prolog_script"></Option>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
-          <Option name="scpArgs"/>
+          <Option name="scpArgs"></Option>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -1926,11 +1846,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id10526X97727" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -1950,11 +1868,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -1976,13 +1892,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id10552X97727" disabled="False" log="False" position="1" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id10552X97727" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id19151X65694"/>
             </Src>
@@ -1999,13 +1913,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id10564X97727" disabled="False" log="True" position="2" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id10564X97727" disabled="False" group="" log="True" position="2" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id19179X65694"/>
             </Src>
@@ -2022,11 +1934,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id10576X97727" disabled="False" group="" log="True" position="3" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2045,11 +1955,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id10588X97727" disabled="False" group="" log="True" position="4" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2068,11 +1976,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id10600X97727" disabled="False" group="" log="True" position="5" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2091,11 +1997,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id10612X97727" disabled="False" group="" log="True" position="6" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2114,13 +2018,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id10624X97727" disabled="False" log="True" position="7" action="Accept" direction="Inbound" comment="">
+          <PolicyRule id="id10624X97727" disabled="False" group="" log="True" position="7" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -2137,13 +2039,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id10636X97727" disabled="False" log="True" position="8" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id10636X97727" disabled="False" group="" log="True" position="8" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id19068X65694"/>
             </Src>
@@ -2160,13 +2060,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id10648X97727" disabled="False" log="True" position="9" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id10648X97727" disabled="False" group="" log="True" position="9" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id19208X65694"/>
             </Src>
@@ -2183,13 +2081,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id10660X97727" disabled="False" log="True" position="10" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id10660X97727" disabled="False" group="" log="True" position="10" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id19240X65694"/>
             </Src>
@@ -2206,11 +2102,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id10672X97727" disabled="False" group="" log="False" position="11" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2230,11 +2124,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id10685X97727" disabled="False" group="" log="False" position="12" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2253,11 +2145,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id10697X97727" disabled="False" group="" log="False" position="13" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2280,11 +2170,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -2304,34 +2192,34 @@
         <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
-          <Option name="action_on_reject"/>
-          <Option name="activationCmd"/>
+          <Option name="action_on_reject"></Option>
+          <Option name="activationCmd"></Option>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">True</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="classify_mark_terminating">False</Option>
           <Option name="cmdline">-xt</Option>
-          <Option name="compiler"/>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="eliminate_duplicates">true</Option>
           <Option name="enable_ipv6">True</Option>
-          <Option name="epilog_script"/>
+          <Option name="epilog_script"></Option>
           <Option name="fallback_log">False</Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="freebsd_ip_forward">1</Option>
-          <Option name="freebsd_ip_redirect"/>
-          <Option name="freebsd_ip_sourceroute"/>
+          <Option name="freebsd_ip_redirect"></Option>
+          <Option name="freebsd_ip_sourceroute"></Option>
           <Option name="freebsd_ipv6_forward">1</Option>
-          <Option name="freebsd_path_ipf"/>
-          <Option name="freebsd_path_ipfw"/>
-          <Option name="freebsd_path_ipnat"/>
-          <Option name="freebsd_path_sysctl"/>
+          <Option name="freebsd_path_ipf"></Option>
+          <Option name="freebsd_path_ipfw"></Option>
+          <Option name="freebsd_path_ipnat"></Option>
+          <Option name="freebsd_path_sysctl"></Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="in_out_code">True</Option>
           <Option name="iosacl_acl_basic">False</Option>
@@ -2340,7 +2228,7 @@
           <Option name="iosacl_acl_temp_addr">1.1.1.0/24</Option>
           <Option name="iosacl_add_clear_statements">true</Option>
           <Option name="iosacl_assume_fw_part_of_any">true</Option>
-          <Option name="iosacl_epilog_script"/>
+          <Option name="iosacl_epilog_script"></Option>
           <Option name="iosacl_generate_logging_commands">False</Option>
           <Option name="iosacl_include_comments">True</Option>
           <Option name="iosacl_logging_buffered">False</Option>
@@ -2349,13 +2237,13 @@
           <Option name="iosacl_logging_console_level">2</Option>
           <Option name="iosacl_logging_timestamp">False</Option>
           <Option name="iosacl_logging_trap_level">2</Option>
-          <Option name="iosacl_prolog_script"/>
+          <Option name="iosacl_prolog_script"></Option>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"/>
-          <Option name="iosacl_syslog_host"/>
-          <Option name="ipt_mangle_only_rulesets"/>
+          <Option name="iosacl_syslog_facility"></Option>
+          <Option name="iosacl_syslog_host"></Option>
+          <Option name="ipt_mangle_only_rulesets"></Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
-          <Option name="limit_suffix"/>
+          <Option name="limit_suffix"></Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">1</Option>
           <Option name="load_modules">True</Option>
@@ -2374,14 +2262,14 @@
           <Option name="mgmt_ssh">True</Option>
           <Option name="modulate_state">False</Option>
           <Option name="no_ipv6_default_policy">False</Option>
-          <Option name="openbsd_ip_directed_broadcast"/>
+          <Option name="openbsd_ip_directed_broadcast"></Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="openbsd_ip_redirect"/>
-          <Option name="openbsd_ip_sourceroute"/>
+          <Option name="openbsd_ip_redirect"></Option>
+          <Option name="openbsd_ip_sourceroute"></Option>
           <Option name="openbsd_ipv6_forward">1</Option>
-          <Option name="openbsd_path_pfctl"/>
-          <Option name="openbsd_path_sysctl"/>
-          <Option name="output_file"/>
+          <Option name="openbsd_path_pfctl"></Option>
+          <Option name="openbsd_path_sysctl"></Option>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">False</Option>
           <Option name="pf_adaptive_end">0</Option>
           <Option name="pf_adaptive_start">0</Option>
@@ -2400,7 +2288,7 @@
           <Option name="pf_limit_states">10000</Option>
           <Option name="pf_limit_table_entries">0</Option>
           <Option name="pf_limit_tables">0</Option>
-          <Option name="pf_optimization"/>
+          <Option name="pf_optimization"></Option>
           <Option name="pf_other_first">0</Option>
           <Option name="pf_other_multiple">0</Option>
           <Option name="pf_other_single">0</Option>
@@ -2452,12 +2340,12 @@
           <Option name="pix_syslog_device_id_supported">false</Option>
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="prolog_place">fw_file</Option>
-          <Option name="prolog_script"/>
+          <Option name="prolog_script"></Option>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
-          <Option name="scpArgs"/>
+          <Option name="scpArgs"></Option>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -2489,11 +2377,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id12152X53662" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2513,11 +2399,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -2539,11 +2423,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id12202X53662" disabled="False" group="" log="True" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2562,11 +2444,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -2589,11 +2469,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -2613,34 +2491,34 @@
         <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
-          <Option name="action_on_reject"/>
-          <Option name="activationCmd"/>
+          <Option name="action_on_reject"></Option>
+          <Option name="activationCmd"></Option>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">True</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="classify_mark_terminating">False</Option>
           <Option name="cmdline">-xt</Option>
-          <Option name="compiler"/>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="eliminate_duplicates">true</Option>
           <Option name="enable_ipv6">True</Option>
-          <Option name="epilog_script"/>
+          <Option name="epilog_script"></Option>
           <Option name="fallback_log">False</Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="freebsd_ip_forward">1</Option>
-          <Option name="freebsd_ip_redirect"/>
-          <Option name="freebsd_ip_sourceroute"/>
+          <Option name="freebsd_ip_redirect"></Option>
+          <Option name="freebsd_ip_sourceroute"></Option>
           <Option name="freebsd_ipv6_forward">1</Option>
-          <Option name="freebsd_path_ipf"/>
-          <Option name="freebsd_path_ipfw"/>
-          <Option name="freebsd_path_ipnat"/>
-          <Option name="freebsd_path_sysctl"/>
+          <Option name="freebsd_path_ipf"></Option>
+          <Option name="freebsd_path_ipfw"></Option>
+          <Option name="freebsd_path_ipnat"></Option>
+          <Option name="freebsd_path_sysctl"></Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="in_out_code">True</Option>
           <Option name="iosacl_acl_basic">False</Option>
@@ -2649,7 +2527,7 @@
           <Option name="iosacl_acl_temp_addr">fe80::21d:9ff:aaaa:bbbb/64</Option>
           <Option name="iosacl_add_clear_statements">true</Option>
           <Option name="iosacl_assume_fw_part_of_any">true</Option>
-          <Option name="iosacl_epilog_script"/>
+          <Option name="iosacl_epilog_script"></Option>
           <Option name="iosacl_generate_logging_commands">False</Option>
           <Option name="iosacl_include_comments">True</Option>
           <Option name="iosacl_logging_buffered">False</Option>
@@ -2658,13 +2536,13 @@
           <Option name="iosacl_logging_console_level">1</Option>
           <Option name="iosacl_logging_timestamp">False</Option>
           <Option name="iosacl_logging_trap_level">1</Option>
-          <Option name="iosacl_prolog_script"/>
+          <Option name="iosacl_prolog_script"></Option>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"/>
-          <Option name="iosacl_syslog_host"/>
-          <Option name="ipt_mangle_only_rulesets"/>
+          <Option name="iosacl_syslog_facility"></Option>
+          <Option name="iosacl_syslog_host"></Option>
+          <Option name="ipt_mangle_only_rulesets"></Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
-          <Option name="limit_suffix"/>
+          <Option name="limit_suffix"></Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">1</Option>
           <Option name="load_modules">True</Option>
@@ -2679,18 +2557,18 @@
           <Option name="loopback_interface">lo0</Option>
           <Option name="macosx_ip_forward">1</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modulate_state">False</Option>
           <Option name="no_ipv6_default_policy">False</Option>
-          <Option name="openbsd_ip_directed_broadcast"/>
+          <Option name="openbsd_ip_directed_broadcast"></Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="openbsd_ip_redirect"/>
-          <Option name="openbsd_ip_sourceroute"/>
+          <Option name="openbsd_ip_redirect"></Option>
+          <Option name="openbsd_ip_sourceroute"></Option>
           <Option name="openbsd_ipv6_forward">1</Option>
-          <Option name="openbsd_path_pfctl"/>
-          <Option name="openbsd_path_sysctl"/>
-          <Option name="output_file"/>
+          <Option name="openbsd_path_pfctl"></Option>
+          <Option name="openbsd_path_sysctl"></Option>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">False</Option>
           <Option name="pf_adaptive_end">0</Option>
           <Option name="pf_adaptive_start">0</Option>
@@ -2709,7 +2587,7 @@
           <Option name="pf_limit_states">10000</Option>
           <Option name="pf_limit_table_entries">0</Option>
           <Option name="pf_limit_tables">0</Option>
-          <Option name="pf_optimization"/>
+          <Option name="pf_optimization"></Option>
           <Option name="pf_other_first">0</Option>
           <Option name="pf_other_multiple">0</Option>
           <Option name="pf_other_single">0</Option>
@@ -2761,12 +2639,12 @@
           <Option name="pix_syslog_device_id_supported">false</Option>
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="prolog_place">fw_file</Option>
-          <Option name="prolog_script"/>
+          <Option name="prolog_script"></Option>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
-          <Option name="scpArgs"/>
+          <Option name="scpArgs"></Option>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -2781,7 +2659,7 @@
           <RuleSetOptions/>
         </NAT>
         <Policy id="id4333X40592" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id4334X40592" disabled="False" log="True" position="0" action="Deny" direction="Inbound" comment="anti-spoofing">
+          <PolicyRule id="id4334X40592" disabled="False" group="" log="True" position="0" action="Deny" direction="Inbound" comment="anti-spoofing">
             <Src neg="False">
               <ObjectRef ref="id46412C4226611"/>
             </Src>
@@ -2798,13 +2676,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4346X40592" disabled="False" log="False" position="1" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4346X40592" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -2822,13 +2698,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4358X40592" disabled="False" log="False" position="2" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4358X40592" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -2847,11 +2721,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4371X40592" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -2871,13 +2743,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4383X40592" disabled="False" log="False" position="4" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4383X40592" disabled="False" group="" log="False" position="4" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -2895,13 +2765,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4395X40592" disabled="False" log="False" position="5" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4395X40592" disabled="False" group="" log="False" position="5" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -2919,13 +2787,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4407X40592" disabled="False" log="False" position="6" action="Accept" direction="Inbound" comment="">
+          <PolicyRule id="id4407X40592" disabled="False" group="" log="False" position="6" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -2943,13 +2809,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4419X40592" disabled="False" log="False" position="7" action="Accept" direction="Inbound" comment="">
+          <PolicyRule id="id4419X40592" disabled="False" group="" log="False" position="7" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -2967,13 +2831,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4431X40592" disabled="False" log="False" position="8" action="Accept" direction="Inbound" comment="">
+          <PolicyRule id="id4431X40592" disabled="False" group="" log="False" position="8" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -2991,13 +2853,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4443X40592" disabled="False" log="False" position="9" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4443X40592" disabled="False" group="" log="False" position="9" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4641456929061"/>
             </Src>
@@ -3015,13 +2875,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4455X40592" disabled="False" log="False" position="10" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4455X40592" disabled="False" group="" log="False" position="10" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4641456929061"/>
             </Src>
@@ -3039,13 +2897,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4467X40592" disabled="False" log="False" position="11" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4467X40592" disabled="False" group="" log="False" position="11" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4641456929061"/>
             </Src>
@@ -3063,13 +2919,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4479X40592" disabled="False" log="False" position="12" action="Accept" direction="Both" comment="interface ethernet1 has address on network 10.10.10.0/24,&#10;therefore net-10.10.10 is behind the router and we do&#10;not need to put rules 12-18 in outbound acl of eth0">
+          <PolicyRule id="id4479X40592" disabled="False" group="" log="False" position="12" action="Accept" direction="Both" comment="interface ethernet1 has address on network 10.10.10.0/24,&#10;therefore net-10.10.10 is behind the router and we do&#10;not need to put rules 12-18 in outbound acl of eth0">
             <Src neg="False">
               <ObjectRef ref="id4641456629061"/>
             </Src>
@@ -3087,13 +2941,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4491X40592" disabled="False" log="False" position="13" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4491X40592" disabled="False" group="" log="False" position="13" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4641456629061"/>
             </Src>
@@ -3111,13 +2963,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4503X40592" disabled="False" log="False" position="14" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4503X40592" disabled="False" group="" log="False" position="14" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4641456629061"/>
             </Src>
@@ -3135,13 +2985,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4515X40592" disabled="False" log="False" position="15" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4515X40592" disabled="False" group="" log="False" position="15" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4641456629061"/>
             </Src>
@@ -3159,13 +3007,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4527X40592" disabled="False" log="False" position="16" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4527X40592" disabled="False" group="" log="False" position="16" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4641456629061"/>
             </Src>
@@ -3183,13 +3029,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4539X40592" disabled="False" log="False" position="17" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4539X40592" disabled="False" group="" log="False" position="17" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4641456629061"/>
             </Src>
@@ -3207,13 +3051,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4551X40592" disabled="False" log="False" position="18" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4551X40592" disabled="False" group="" log="False" position="18" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4641456629061"/>
             </Src>
@@ -3231,11 +3073,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4563X40592" disabled="False" group="" log="False" position="19" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -3255,11 +3095,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#7694C0</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4575X40592" disabled="False" group="" log="False" position="20" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -3279,13 +3117,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#7694C0</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4587X40592" disabled="False" log="True" position="21" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id4587X40592" disabled="False" group="" log="True" position="21" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3302,11 +3138,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -3355,10 +3189,10 @@
           <Option name="accept_established">true</Option>
           <Option name="accept_new_tcp_with_no_syn">true</Option>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
-          <Option name="compiler"/>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">true</Option>
           <Option name="eliminate_duplicates">true</Option>
           <Option name="filesystem">/etc</Option>
@@ -3387,8 +3221,8 @@
           <Option name="iosacl_logging_trap_level">3</Option>
           <Option name="iosacl_prolog_script">! This is prolog</Option>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"/>
-          <Option name="iosacl_syslog_host"/>
+          <Option name="iosacl_syslog_facility"></Option>
+          <Option name="iosacl_syslog_host"></Option>
           <Option name="iosacl_use_acl_remarks">False</Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
           <Option name="limit_value">0</Option>
@@ -3403,7 +3237,7 @@
           <Option name="mgmt_addr">10.10.11.10</Option>
           <Option name="mgmt_ssh">True</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">false</Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
@@ -3425,10 +3259,10 @@
           <Option name="procurve_acl_acl_basic">False</Option>
           <Option name="procurve_acl_acl_no_clear">True</Option>
           <Option name="procurve_acl_acl_substitution">False</Option>
-          <Option name="procurve_acl_acl_temp_addr"/>
+          <Option name="procurve_acl_acl_temp_addr"></Option>
           <Option name="procurve_acl_add_clear_statements">true</Option>
           <Option name="procurve_acl_assume_fw_part_of_any">true</Option>
-          <Option name="procurve_acl_epilog_script"/>
+          <Option name="procurve_acl_epilog_script"></Option>
           <Option name="procurve_acl_generate_logging_commands">False</Option>
           <Option name="procurve_acl_include_comments">False</Option>
           <Option name="procurve_acl_logging_buffered">False</Option>
@@ -3437,15 +3271,15 @@
           <Option name="procurve_acl_logging_console_level">4</Option>
           <Option name="procurve_acl_logging_timestamp">False</Option>
           <Option name="procurve_acl_logging_trap_level">4</Option>
-          <Option name="procurve_acl_prolog_script"/>
-          <Option name="procurve_acl_syslog_facility"/>
-          <Option name="procurve_acl_syslog_host"/>
+          <Option name="procurve_acl_prolog_script"></Option>
+          <Option name="procurve_acl_syslog_facility"></Option>
+          <Option name="procurve_acl_syslog_host"></Option>
           <Option name="procurve_acl_use_acl_remarks">False</Option>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
-          <Option name="scpArgs"/>
+          <Option name="scpArgs"></Option>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="use_scp">False</Option>
           <Option name="verify_interfaces">true</Option>
@@ -3456,7 +3290,7 @@
           <RuleSetOptions/>
         </NAT>
         <Policy id="id4751X40592" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id4752X40592" disabled="False" log="True" position="0" action="Deny" direction="Inbound" comment="anti-spoofing">
+          <PolicyRule id="id4752X40592" disabled="False" group="" log="True" position="0" action="Deny" direction="Inbound" comment="anti-spoofing">
             <Src neg="False">
               <ObjectRef ref="id46412C4226611"/>
             </Src>
@@ -3473,13 +3307,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4764X40592" disabled="False" log="False" position="1" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4764X40592" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3497,13 +3329,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4776X40592" disabled="False" log="False" position="2" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4776X40592" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3522,11 +3352,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4789X40592" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -3546,13 +3374,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4801X40592" disabled="False" log="False" position="4" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4801X40592" disabled="False" group="" log="False" position="4" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3570,13 +3396,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4813X40592" disabled="False" log="False" position="5" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4813X40592" disabled="False" group="" log="False" position="5" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3594,13 +3418,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4825X40592" disabled="False" log="False" position="6" action="Accept" direction="Inbound" comment="">
+          <PolicyRule id="id4825X40592" disabled="False" group="" log="False" position="6" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3618,13 +3440,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4837X40592" disabled="False" log="False" position="7" action="Accept" direction="Inbound" comment="">
+          <PolicyRule id="id4837X40592" disabled="False" group="" log="False" position="7" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3642,13 +3462,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4849X40592" disabled="False" log="False" position="8" action="Accept" direction="Inbound" comment="">
+          <PolicyRule id="id4849X40592" disabled="False" group="" log="False" position="8" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3666,13 +3484,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4861X40592" disabled="False" log="False" position="9" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4861X40592" disabled="False" group="" log="False" position="9" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4641456929061"/>
             </Src>
@@ -3690,13 +3506,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4873X40592" disabled="False" log="False" position="10" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4873X40592" disabled="False" group="" log="False" position="10" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4641456929061"/>
             </Src>
@@ -3714,13 +3528,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4885X40592" disabled="False" log="False" position="11" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4885X40592" disabled="False" group="" log="False" position="11" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4641456929061"/>
             </Src>
@@ -3738,13 +3550,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4897X40592" disabled="False" log="False" position="12" action="Accept" direction="Both" comment="interface ethernet1 has address on network 10.10.10.0/24,&#10;therefore net-10.10.10 is behind the router and we do&#10;not need to put rules 12-18 in outbound acl of eth0">
+          <PolicyRule id="id4897X40592" disabled="False" group="" log="False" position="12" action="Accept" direction="Both" comment="interface ethernet1 has address on network 10.10.10.0/24,&#10;therefore net-10.10.10 is behind the router and we do&#10;not need to put rules 12-18 in outbound acl of eth0">
             <Src neg="False">
               <ObjectRef ref="id4641456629061"/>
             </Src>
@@ -3762,13 +3572,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4909X40592" disabled="False" log="False" position="13" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4909X40592" disabled="False" group="" log="False" position="13" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4641456629061"/>
             </Src>
@@ -3786,13 +3594,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4921X40592" disabled="False" log="False" position="14" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4921X40592" disabled="False" group="" log="False" position="14" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4641456629061"/>
             </Src>
@@ -3810,13 +3616,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4933X40592" disabled="False" log="False" position="15" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4933X40592" disabled="False" group="" log="False" position="15" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4641456629061"/>
             </Src>
@@ -3834,13 +3638,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4945X40592" disabled="False" log="False" position="16" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4945X40592" disabled="False" group="" log="False" position="16" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4641456629061"/>
             </Src>
@@ -3858,13 +3660,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4957X40592" disabled="False" log="False" position="17" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4957X40592" disabled="False" group="" log="False" position="17" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4641456629061"/>
             </Src>
@@ -3882,13 +3682,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4969X40592" disabled="False" log="False" position="18" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id4969X40592" disabled="False" group="" log="False" position="18" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4641456629061"/>
             </Src>
@@ -3906,11 +3704,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4981X40592" disabled="False" group="" log="False" position="19" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -3930,11 +3726,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#7694C0</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4993X40592" disabled="False" group="" log="False" position="20" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -3954,13 +3748,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#7694C0</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id5005X40592" disabled="False" log="True" position="21" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id5005X40592" disabled="False" group="" log="True" position="21" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3977,11 +3769,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -4030,14 +3820,14 @@
           <Option name="accept_established">true</Option>
           <Option name="accept_new_tcp_with_no_syn">true</Option>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
-          <Option name="compiler"/>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">true</Option>
           <Option name="eliminate_duplicates">true</Option>
-          <Option name="filesystem"/>
-          <Option name="firewall_dir"/>
+          <Option name="filesystem"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any_and_networks">true</Option>
           <Option name="freebsd_ip_forward">1</Option>
           <Option name="ignore_empty_groups">False</Option>
@@ -4062,8 +3852,8 @@
           <Option name="iosacl_logging_trap_level">3</Option>
           <Option name="iosacl_prolog_script">! This is prolog</Option>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"/>
-          <Option name="iosacl_syslog_host"/>
+          <Option name="iosacl_syslog_facility"></Option>
+          <Option name="iosacl_syslog_host"></Option>
           <Option name="iosacl_use_acl_remarks">False</Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
           <Option name="limit_value">0</Option>
@@ -4078,7 +3868,7 @@
           <Option name="mgmt_addr">10.10.11.10</Option>
           <Option name="mgmt_ssh">True</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">false</Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
@@ -4103,7 +3893,7 @@
           <Option name="procurve_acl_acl_temp_addr">10.10.11.10</Option>
           <Option name="procurve_acl_add_clear_statements">true</Option>
           <Option name="procurve_acl_assume_fw_part_of_any">true</Option>
-          <Option name="procurve_acl_epilog_script"/>
+          <Option name="procurve_acl_epilog_script"></Option>
           <Option name="procurve_acl_generate_logging_commands">False</Option>
           <Option name="procurve_acl_include_comments">True</Option>
           <Option name="procurve_acl_logging_buffered">False</Option>
@@ -4112,15 +3902,15 @@
           <Option name="procurve_acl_logging_console_level">6</Option>
           <Option name="procurve_acl_logging_timestamp">False</Option>
           <Option name="procurve_acl_logging_trap_level">6</Option>
-          <Option name="procurve_acl_prolog_script"/>
-          <Option name="procurve_acl_syslog_facility"/>
-          <Option name="procurve_acl_syslog_host"/>
+          <Option name="procurve_acl_prolog_script"></Option>
+          <Option name="procurve_acl_syslog_facility"></Option>
+          <Option name="procurve_acl_syslog_host"></Option>
           <Option name="procurve_acl_use_acl_remarks">False</Option>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
-          <Option name="scpArgs"/>
+          <Option name="scpArgs"></Option>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="use_scp">True</Option>
           <Option name="verify_interfaces">true</Option>
@@ -4131,7 +3921,7 @@
           <RuleSetOptions/>
         </NAT>
         <Policy id="id5599X54035" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id5600X54035" disabled="False" log="True" position="0" action="Deny" direction="Inbound" comment="anti-spoofing">
+          <PolicyRule id="id5600X54035" disabled="False" group="" log="True" position="0" action="Deny" direction="Inbound" comment="anti-spoofing">
             <Src neg="False">
               <ObjectRef ref="id46412C4226611"/>
             </Src>
@@ -4148,13 +3938,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id5612X54035" disabled="False" log="False" position="1" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id5612X54035" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4172,13 +3960,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id5624X54035" disabled="False" log="False" position="2" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id5624X54035" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4197,11 +3983,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id5637X54035" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4221,13 +4005,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id5649X54035" disabled="False" log="False" position="4" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id5649X54035" disabled="False" group="" log="False" position="4" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4245,13 +4027,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id5661X54035" disabled="False" log="False" position="5" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id5661X54035" disabled="False" group="" log="False" position="5" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4269,13 +4049,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id5673X54035" disabled="False" log="False" position="6" action="Accept" direction="Inbound" comment="">
+          <PolicyRule id="id5673X54035" disabled="False" group="" log="False" position="6" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4293,13 +4071,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id5685X54035" disabled="False" log="False" position="7" action="Accept" direction="Inbound" comment="">
+          <PolicyRule id="id5685X54035" disabled="False" group="" log="False" position="7" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4317,13 +4093,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id5697X54035" disabled="False" log="False" position="8" action="Accept" direction="Inbound" comment="">
+          <PolicyRule id="id5697X54035" disabled="False" group="" log="False" position="8" action="Accept" direction="Inbound" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4341,13 +4115,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#8BC065</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id5709X54035" disabled="False" log="False" position="9" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id5709X54035" disabled="False" group="" log="False" position="9" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4641456929061"/>
             </Src>
@@ -4365,13 +4137,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id5721X54035" disabled="False" log="False" position="10" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id5721X54035" disabled="False" group="" log="False" position="10" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4641456929061"/>
             </Src>
@@ -4389,13 +4159,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id5733X54035" disabled="False" log="False" position="11" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id5733X54035" disabled="False" group="" log="False" position="11" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4641456929061"/>
             </Src>
@@ -4413,13 +4181,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C0BA44</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id5745X54035" disabled="False" log="False" position="12" action="Accept" direction="Both" comment="interface ethernet1 has address on network 10.10.10.0/24,&#10;therefore net-10.10.10 is behind the router and we do&#10;not need to put rules 12-18 in outbound acl of eth0">
+          <PolicyRule id="id5745X54035" disabled="False" group="" log="False" position="12" action="Accept" direction="Both" comment="interface ethernet1 has address on network 10.10.10.0/24,&#10;therefore net-10.10.10 is behind the router and we do&#10;not need to put rules 12-18 in outbound acl of eth0">
             <Src neg="False">
               <ObjectRef ref="id4641456629061"/>
             </Src>
@@ -4437,13 +4203,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id5757X54035" disabled="False" log="False" position="13" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id5757X54035" disabled="False" group="" log="False" position="13" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4641456629061"/>
             </Src>
@@ -4461,13 +4225,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id5769X54035" disabled="False" log="False" position="14" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id5769X54035" disabled="False" group="" log="False" position="14" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4641456629061"/>
             </Src>
@@ -4485,13 +4247,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id5781X54035" disabled="False" log="False" position="15" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id5781X54035" disabled="False" group="" log="False" position="15" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4641456629061"/>
             </Src>
@@ -4509,13 +4269,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id5793X54035" disabled="False" log="False" position="16" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id5793X54035" disabled="False" group="" log="False" position="16" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4641456629061"/>
             </Src>
@@ -4533,13 +4291,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id5805X54035" disabled="False" log="False" position="17" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id5805X54035" disabled="False" group="" log="False" position="17" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4641456629061"/>
             </Src>
@@ -4557,13 +4313,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id5817X54035" disabled="False" log="False" position="18" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id5817X54035" disabled="False" group="" log="False" position="18" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id4641456629061"/>
             </Src>
@@ -4581,11 +4335,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#C86E6E</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id5829X54035" disabled="False" group="" log="False" position="19" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4605,11 +4357,9 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#7694C0</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id5841X54035" disabled="False" group="" log="False" position="20" action="Accept" direction="Both" comment="">
             <Src neg="False">
@@ -4629,13 +4379,11 @@
             </When>
             <PolicyRuleOptions>
               <Option name="color">#7694C0</Option>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">False</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id5853X54035" disabled="False" log="True" position="21" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id5853X54035" disabled="False" group="" log="True" position="21" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4652,11 +4400,9 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
+              <Option name="pf_classify_str"></Option>
               <Option name="stateless">True</Option>
-            
-          <Option name="pf_classify_str"/>
-          </PolicyRuleOptions>
-  
+            </PolicyRuleOptions>
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
@@ -4711,10 +4457,10 @@
           <Option name="accept_established">true</Option>
           <Option name="accept_new_tcp_with_no_syn">true</Option>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="check_shading">False</Option>
-          <Option name="compiler"/>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">true</Option>
           <Option name="eliminate_duplicates">true</Option>
           <Option name="filesystem">/etc</Option>
@@ -4743,8 +4489,8 @@
           <Option name="iosacl_logging_trap_level">3</Option>
           <Option name="iosacl_prolog_script">! This is prolog</Option>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"/>
-          <Option name="iosacl_syslog_host"/>
+          <Option name="iosacl_syslog_facility"></Option>
+          <Option name="iosacl_syslog_host"></Option>
           <Option name="iosacl_use_acl_remarks">False</Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
           <Option name="limit_value">0</Option>
@@ -4759,7 +4505,7 @@
           <Option name="mgmt_addr">10.10.11.10</Option>
           <Option name="mgmt_ssh">True</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">false</Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
@@ -4784,7 +4530,7 @@
           <Option name="procurve_acl_acl_temp_addr">10.10.11.10</Option>
           <Option name="procurve_acl_add_clear_statements">true</Option>
           <Option name="procurve_acl_assume_fw_part_of_any">true</Option>
-          <Option name="procurve_acl_epilog_script"/>
+          <Option name="procurve_acl_epilog_script"></Option>
           <Option name="procurve_acl_generate_logging_commands">False</Option>
           <Option name="procurve_acl_include_comments">True</Option>
           <Option name="procurve_acl_logging_buffered">False</Option>
@@ -4793,15 +4539,15 @@
           <Option name="procurve_acl_logging_console_level">5</Option>
           <Option name="procurve_acl_logging_timestamp">False</Option>
           <Option name="procurve_acl_logging_trap_level">5</Option>
-          <Option name="procurve_acl_prolog_script"/>
-          <Option name="procurve_acl_syslog_facility"/>
-          <Option name="procurve_acl_syslog_host"/>
+          <Option name="procurve_acl_prolog_script"></Option>
+          <Option name="procurve_acl_syslog_facility"></Option>
+          <Option name="procurve_acl_syslog_host"></Option>
           <Option name="procurve_acl_use_acl_remarks">True</Option>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
-          <Option name="scpArgs"/>
+          <Option name="scpArgs"></Option>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="use_scp">False</Option>
           <Option name="verify_interfaces">true</Option>