diff --git a/test/iosacl/cluster-tests.fwb b/test/iosacl/cluster-tests.fwb
index 1c13dac43..4f4f58503 100644
--- a/test/iosacl/cluster-tests.fwb
+++ b/test/iosacl/cluster-tests.fwb
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
-<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="17" lastModified="1253911075" id="root">
+<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="18" lastModified="1253911075" id="root">
   <Library id="syslib000" color="#d4f8ff" name="Standard" comment="Standard objects" ro="True">
     <AnyNetwork id="sysid0" name="Any" comment="Any Network" ro="False" address="0.0.0.0" netmask="0.0.0.0"/>
     <AnyIPService id="sysid1" protocol_num="0" name="Any" comment="Any IP Service" ro="False"/>
@@ -51,9 +51,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"></Option>
-            <Option name="snmp_description"></Option>
-            <Option name="snmp_location"></Option>
+            <Option name="snmp_contact"/>
+            <Option name="snmp_description"/>
+            <Option name="snmp_location"/>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -69,9 +69,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"></Option>
-            <Option name="snmp_description"></Option>
-            <Option name="snmp_location"></Option>
+            <Option name="snmp_contact"/>
+            <Option name="snmp_description"/>
+            <Option name="snmp_location"/>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -100,16 +100,16 @@
     </ObjectGroup>
     <ServiceGroup id="stdid05" name="Services" comment="" ro="False">
       <CustomService id="stdid14_1" name="ESTABLISHED" comment="This service matches all packets which are part of network connections established through the firewall, or connections 'related' to those established through the firewall. Term 'established' refers to the state tracking mechanism which exists inside iptables and other stateful firewalls and does not mean any particular combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful inspection module made appropriate record in the state table. Usually stateful firewalls keep track of network connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' describes packet belonging to a separate network connection, related to the session firewall is keeping track of. One example is FTP command and FTP data sessions." ro="False" protocol="any" address_family="ipv4">
-        <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+        <CustomServiceCommand platform="Undefined"/>
         <CustomServiceCommand platform="iosacl">established</CustomServiceCommand>
-        <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+        <CustomServiceCommand platform="ipfilter"/>
         <CustomServiceCommand platform="ipfw">established</CustomServiceCommand>
         <CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
       </CustomService>
       <CustomService id="stdid14_2" name="ESTABLISHED ipv6" comment="This service matches all packets which are part of network connections established through the firewall, or connections 'related' to those established through the firewall. Term 'established' refers to the state tracking mechanism which exists inside iptables and other stateful firewalls and does not mean any particular combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful inspection module made appropriate record in the state table. Usually stateful firewalls keep track of network connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' describes packet belonging to a separate network connection, related to the session firewall is keeping track of. One example is FTP command and FTP data sessions." ro="False" protocol="any" address_family="ipv6">
-        <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+        <CustomServiceCommand platform="Undefined"/>
         <CustomServiceCommand platform="iosacl">established</CustomServiceCommand>
-        <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+        <CustomServiceCommand platform="ipfilter"/>
         <CustomServiceCommand platform="ipfw">established</CustomServiceCommand>
         <CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
       </CustomService>
@@ -350,54 +350,54 @@
       </ServiceGroup>
       <ServiceGroup id="stdid13" name="Custom" comment="" ro="False">
         <CustomService id="id3B64EEA8" name="rpc" comment="works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
+          <CustomServiceCommand platform="Undefined"/>
+          <CustomServiceCommand platform="ipf"/>
+          <CustomServiceCommand platform="ipfilter"/>
+          <CustomServiceCommand platform="ipfw"/>
           <CustomServiceCommand platform="iptables">-m record_rpc</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"></CustomServiceCommand>
-          <CustomServiceCommand platform="pix"></CustomServiceCommand>
-          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
+          <CustomServiceCommand platform="pf"/>
+          <CustomServiceCommand platform="pix"/>
+          <CustomServiceCommand platform="unknown"/>
         </CustomService>
         <CustomService id="id3B64EF4E" name="irc-conn" comment="IRC connection tracker, supports DCC.&#10;Works on iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/&#10;" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
+          <CustomServiceCommand platform="Undefined"/>
+          <CustomServiceCommand platform="ipf"/>
+          <CustomServiceCommand platform="ipfilter"/>
+          <CustomServiceCommand platform="ipfw"/>
           <CustomServiceCommand platform="iptables">-m irc</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"></CustomServiceCommand>
-          <CustomServiceCommand platform="pix"></CustomServiceCommand>
-          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
+          <CustomServiceCommand platform="pf"/>
+          <CustomServiceCommand platform="pix"/>
+          <CustomServiceCommand platform="unknown"/>
         </CustomService>
         <CustomService id="id3B64EF50" name="psd" comment="Port scan detector, works only on iptables and  requires patch-o-matic &#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
+          <CustomServiceCommand platform="Undefined"/>
+          <CustomServiceCommand platform="ipf"/>
+          <CustomServiceCommand platform="ipfilter"/>
+          <CustomServiceCommand platform="ipfw"/>
           <CustomServiceCommand platform="iptables">-m psd --psd-weight-threshold 5 --psd-delay-threshold 10000</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"></CustomServiceCommand>
-          <CustomServiceCommand platform="pix"></CustomServiceCommand>
-          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
+          <CustomServiceCommand platform="pf"/>
+          <CustomServiceCommand platform="pix"/>
+          <CustomServiceCommand platform="unknown"/>
         </CustomService>
         <CustomService id="id3B64EF52" name="string" comment="Matches a string in a whole packet, works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
+          <CustomServiceCommand platform="Undefined"/>
+          <CustomServiceCommand platform="ipf"/>
+          <CustomServiceCommand platform="ipfilter"/>
+          <CustomServiceCommand platform="ipfw"/>
           <CustomServiceCommand platform="iptables">-m string --string test_pattern</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"></CustomServiceCommand>
-          <CustomServiceCommand platform="pix"></CustomServiceCommand>
-          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
+          <CustomServiceCommand platform="pf"/>
+          <CustomServiceCommand platform="pix"/>
+          <CustomServiceCommand platform="unknown"/>
         </CustomService>
         <CustomService id="id3B64EF54" name="talk" comment="Talk protocol support. Works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
+          <CustomServiceCommand platform="Undefined"/>
+          <CustomServiceCommand platform="ipf"/>
+          <CustomServiceCommand platform="ipfilter"/>
+          <CustomServiceCommand platform="ipfw"/>
           <CustomServiceCommand platform="iptables">-m talk</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"></CustomServiceCommand>
-          <CustomServiceCommand platform="pix"></CustomServiceCommand>
-          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
+          <CustomServiceCommand platform="pf"/>
+          <CustomServiceCommand platform="pix"/>
+          <CustomServiceCommand platform="unknown"/>
         </CustomService>
       </ServiceGroup>
       <ServiceGroup id="stdid19" name="TagServices" comment="" ro="False"/>
@@ -420,7 +420,7 @@
     <FailoverClusterGroup id="id2719X89830" type="vrrp" name="cluster3:vrrp0:members" comment="">
       <ClusterGroupOptions>
         <Option name="vrrp_secret">vrrp_secret</Option>
-        <Option name="vrrp_vrid"></Option>
+        <Option name="vrrp_vrid"/>
       </ClusterGroupOptions>
     </FailoverClusterGroup>
     <StateSyncClusterGroup id="id2762X92940" type="conntrack" name="State Sync Group-1" comment="">
@@ -438,18 +438,18 @@
         <Option name="iface_disablearp">False</Option>
         <Option name="iface_disableboot">False</Option>
         <Option name="iface_mtu">1500</Option>
-        <Option name="iface_options"></Option>
+        <Option name="iface_options"/>
         <Option name="type">bridge</Option>
-        <Option name="vlan_id"></Option>
+        <Option name="vlan_id"/>
       </InterfaceOptions>
       <Interface id="id10491X48869" dedicated_failover="False" dyn="False" label="" security_level="0" unnum="False" unprotected="False" name="eth2" comment="" ro="False">
         <InterfaceOptions>
           <Option name="iface_disablearp">False</Option>
           <Option name="iface_disableboot">False</Option>
           <Option name="iface_mtu">1500</Option>
-          <Option name="iface_options"></Option>
+          <Option name="iface_options"/>
           <Option name="type">ethernet</Option>
-          <Option name="vlan_id"></Option>
+          <Option name="vlan_id"/>
         </InterfaceOptions>
       </Interface>
       <Interface id="id10493X48869" dedicated_failover="False" dyn="False" label="" security_level="0" unnum="False" unprotected="False" name="eth3" comment="" ro="False">
@@ -486,7 +486,7 @@
         <Option name="iface_disablearp">False</Option>
         <Option name="iface_disableboot">False</Option>
         <Option name="iface_mtu">1500</Option>
-        <Option name="iface_options"></Option>
+        <Option name="iface_options"/>
         <Option name="type">8021q</Option>
         <Option name="vlan_id">100</Option>
       </InterfaceOptions>
@@ -497,7 +497,7 @@
         <Option name="iface_disablearp">False</Option>
         <Option name="iface_disableboot">False</Option>
         <Option name="iface_mtu">1500</Option>
-        <Option name="iface_options"></Option>
+        <Option name="iface_options"/>
         <Option name="type">8021q</Option>
         <Option name="vlan_id">101</Option>
       </InterfaceOptions>
@@ -505,131 +505,149 @@
     <Cluster id="id3631X95766" host_OS="openbsd" inactive="False" lastCompiled="1244758659" lastInstalled="0" lastModified="1244757366" platform="pf" name="pf_cluster_1" comment="" ro="False">
       <NAT id="id3640X95766" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
         <NATRule id="id3162X39764" disabled="False" position="0" action="Translate" comment="">
-          <OSrc neg="False">
+            <OSrc neg="False">
             <ObjectRef ref="id3DC75CE7-1"/>
           </OSrc>
-          <ODst neg="False">
+            <ODst neg="False">
             <ObjectRef ref="sysid0"/>
           </ODst>
-          <OSrv neg="False">
+            <OSrv neg="False">
             <ServiceRef ref="sysid1"/>
           </OSrv>
-          <TSrc neg="False">
+            <TSrc neg="False">
             <ObjectRef ref="sysid0"/>
           </TSrc>
-          <TDst neg="False">
+            <TDst neg="False">
             <ObjectRef ref="sysid0"/>
           </TDst>
-          <TSrv neg="False">
+            <TSrv neg="False">
             <ServiceRef ref="sysid1"/>
           </TSrv>
-          <NATRuleOptions/>
-        </NATRule>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
+            <NATRuleOptions/>
+          </NATRule>
         <NATRule id="id11381X39764" disabled="False" group="" position="1" action="Translate" comment="">
-          <OSrc neg="False">
+            <OSrc neg="False">
             <ObjectRef ref="id3DC75CE7-1"/>
           </OSrc>
-          <ODst neg="False">
+            <ODst neg="False">
             <ObjectRef ref="sysid0"/>
           </ODst>
-          <OSrv neg="False">
+            <OSrv neg="False">
             <ServiceRef ref="sysid1"/>
           </OSrv>
-          <TSrc neg="False">
+            <TSrc neg="False">
             <ObjectRef ref="sysid0"/>
           </TSrc>
-          <TDst neg="False">
+            <TDst neg="False">
             <ObjectRef ref="sysid0"/>
           </TDst>
-          <TSrv neg="False">
+            <TSrv neg="False">
             <ServiceRef ref="sysid1"/>
           </TSrv>
-          <NATRuleOptions/>
-        </NATRule>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
+            <NATRuleOptions/>
+          </NATRule>
         <NATRule id="id11397X39764" disabled="False" group="" position="2" action="Translate" comment="">
-          <OSrc neg="False">
+            <OSrc neg="False">
             <ObjectRef ref="id3DC75CE7-1"/>
           </OSrc>
-          <ODst neg="False">
+            <ODst neg="False">
             <ObjectRef ref="sysid0"/>
           </ODst>
-          <OSrv neg="False">
+            <OSrv neg="False">
             <ServiceRef ref="sysid1"/>
           </OSrv>
-          <TSrc neg="False">
+            <TSrc neg="False">
             <ObjectRef ref="id11417X39764"/>
           </TSrc>
-          <TDst neg="False">
+            <TDst neg="False">
             <ObjectRef ref="sysid0"/>
           </TDst>
-          <TSrv neg="False">
+            <TSrv neg="False">
             <ServiceRef ref="sysid1"/>
           </TSrv>
-          <NATRuleOptions/>
-        </NATRule>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
+            <NATRuleOptions/>
+          </NATRule>
         <NATRule id="id15078X39764" disabled="False" group="" position="3" action="Translate" comment="">
-          <OSrc neg="False">
+            <OSrc neg="False">
             <ObjectRef ref="sysid0"/>
           </OSrc>
-          <ODst neg="False">
+            <ODst neg="False">
             <ObjectRef ref="sysid0"/>
           </ODst>
-          <OSrv neg="False">
+            <OSrv neg="False">
             <ServiceRef ref="tcp-HTTP"/>
           </OSrv>
-          <TSrc neg="False">
+            <TSrc neg="False">
             <ObjectRef ref="sysid0"/>
           </TSrc>
-          <TDst neg="False">
+            <TDst neg="False">
             <ObjectRef ref="id15840X39764"/>
           </TDst>
-          <TSrv neg="False">
+            <TSrv neg="False">
             <ServiceRef ref="sysid1"/>
           </TSrv>
-          <NATRuleOptions/>
-        </NATRule>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
+            <NATRuleOptions/>
+          </NATRule>
         <NATRule id="id16591X39764" disabled="False" group="" position="4" action="Translate" comment="">
-          <OSrc neg="False">
+            <OSrc neg="False">
             <ObjectRef ref="sysid0"/>
           </OSrc>
-          <ODst neg="False">
+            <ODst neg="False">
             <ObjectRef ref="sysid0"/>
           </ODst>
-          <OSrv neg="False">
+            <OSrv neg="False">
             <ServiceRef ref="tcp-HTTP"/>
           </OSrv>
-          <TSrc neg="False">
+            <TSrc neg="False">
             <ObjectRef ref="sysid0"/>
           </TSrc>
-          <TDst neg="False">
+            <TDst neg="False">
             <ObjectRef ref="id15840X39764"/>
           </TDst>
-          <TSrv neg="False">
+            <TSrv neg="False">
             <ServiceRef ref="sysid1"/>
           </TSrv>
-          <NATRuleOptions/>
-        </NATRule>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
+            <NATRuleOptions/>
+          </NATRule>
         <NATRule id="id16611X39764" disabled="False" group="" position="5" action="Translate" comment="">
-          <OSrc neg="False">
+            <OSrc neg="False">
             <ObjectRef ref="sysid0"/>
           </OSrc>
-          <ODst neg="False">
+            <ODst neg="False">
             <ObjectRef ref="id11417X39764"/>
           </ODst>
-          <OSrv neg="False">
+            <OSrv neg="False">
             <ServiceRef ref="tcp-HTTP"/>
           </OSrv>
-          <TSrc neg="False">
+            <TSrc neg="False">
             <ObjectRef ref="sysid0"/>
           </TSrc>
-          <TDst neg="False">
+            <TDst neg="False">
             <ObjectRef ref="id15840X39764"/>
           </TDst>
-          <TSrv neg="False">
+            <TSrv neg="False">
             <ServiceRef ref="sysid1"/>
           </TSrv>
-          <NATRuleOptions/>
-        </NATRule>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
+            <NATRuleOptions/>
+          </NATRule>
         <RuleSetOptions/>
       </NAT>
       <Policy id="id3639X95766" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
@@ -806,18 +824,18 @@
       </Management>
       <FirewallOptions>
         <Option name="accept_new_tcp_with_no_syn">False</Option>
-        <Option name="activationCmd"></Option>
-        <Option name="admUser"></Option>
-        <Option name="altAddress"></Option>
+        <Option name="activationCmd"/>
+        <Option name="admUser"/>
+        <Option name="altAddress"/>
         <Option name="check_shading">False</Option>
-        <Option name="cmdline"></Option>
-        <Option name="compiler"></Option>
+        <Option name="cmdline"/>
+        <Option name="compiler"/>
         <Option name="configure_carp_interfaces">True</Option>
         <Option name="configure_interfaces">True</Option>
         <Option name="configure_pfsync_interfaces">True</Option>
         <Option name="configure_vlan_interfaces">True</Option>
         <Option name="debug">False</Option>
-        <Option name="epilog_script"></Option>
+        <Option name="epilog_script"/>
         <Option name="fallback_log">False</Option>
         <Option name="firewall_dir">/etc</Option>
         <Option name="ignore_empty_groups">False</Option>
@@ -826,11 +844,11 @@
         <Option name="log_prefix">RULE %N -- %A </Option>
         <Option name="loopback_interface">lo0</Option>
         <Option name="manage_virtual_addr">True</Option>
-        <Option name="mgmt_addr"></Option>
+        <Option name="mgmt_addr"/>
         <Option name="mgmt_ssh">False</Option>
         <Option name="modulate_state">False</Option>
         <Option name="openbsd_ip_forward">1</Option>
-        <Option name="output_file"></Option>
+        <Option name="output_file"/>
         <Option name="pass_all_out">false</Option>
         <Option name="pf_adaptive_end">0</Option>
         <Option name="pf_adaptive_start">0</Option>
@@ -850,7 +868,7 @@
         <Option name="pf_limit_states">10000</Option>
         <Option name="pf_limit_table_entries">0</Option>
         <Option name="pf_limit_tables">0</Option>
-        <Option name="pf_optimization"></Option>
+        <Option name="pf_optimization"/>
         <Option name="pf_other_first">0</Option>
         <Option name="pf_other_multiple">0</Option>
         <Option name="pf_other_single">0</Option>
@@ -890,9 +908,9 @@
         <Option name="pf_udp_multiple">0</Option>
         <Option name="pf_udp_single">0</Option>
         <Option name="prolog_place">fw_file</Option>
-        <Option name="prolog_script"></Option>
-        <Option name="scpArgs"></Option>
-        <Option name="sshArgs"></Option>
+        <Option name="prolog_script"/>
+        <Option name="scpArgs"/>
+        <Option name="sshArgs"/>
       </FirewallOptions>
     </Firewall>
     <Firewall id="id3337X26920" host_OS="openbsd" inactive="False" lastCompiled="0" lastInstalled="0" lastModified="1244783399" platform="pf" version="4.x" name="openbsd-2" comment="" ro="False">
@@ -920,18 +938,18 @@
       </Management>
       <FirewallOptions>
         <Option name="accept_new_tcp_with_no_syn">False</Option>
-        <Option name="activationCmd"></Option>
-        <Option name="admUser"></Option>
-        <Option name="altAddress"></Option>
+        <Option name="activationCmd"/>
+        <Option name="admUser"/>
+        <Option name="altAddress"/>
         <Option name="check_shading">False</Option>
-        <Option name="cmdline"></Option>
-        <Option name="compiler"></Option>
+        <Option name="cmdline"/>
+        <Option name="compiler"/>
         <Option name="configure_carp_interfaces">True</Option>
         <Option name="configure_interfaces">True</Option>
         <Option name="configure_pfsync_interfaces">False</Option>
         <Option name="configure_vlan_interfaces">False</Option>
         <Option name="debug">False</Option>
-        <Option name="epilog_script"></Option>
+        <Option name="epilog_script"/>
         <Option name="fallback_log">False</Option>
         <Option name="firewall_dir">/etc</Option>
         <Option name="ignore_empty_groups">False</Option>
@@ -940,11 +958,11 @@
         <Option name="log_prefix">RULE %N -- %A </Option>
         <Option name="loopback_interface">lo0</Option>
         <Option name="manage_virtual_addr">True</Option>
-        <Option name="mgmt_addr"></Option>
+        <Option name="mgmt_addr"/>
         <Option name="mgmt_ssh">False</Option>
         <Option name="modulate_state">False</Option>
         <Option name="openbsd_ip_forward">1</Option>
-        <Option name="output_file"></Option>
+        <Option name="output_file"/>
         <Option name="pass_all_out">false</Option>
         <Option name="pf_adaptive_end">0</Option>
         <Option name="pf_adaptive_start">0</Option>
@@ -964,7 +982,7 @@
         <Option name="pf_limit_states">10000</Option>
         <Option name="pf_limit_table_entries">0</Option>
         <Option name="pf_limit_tables">0</Option>
-        <Option name="pf_optimization"></Option>
+        <Option name="pf_optimization"/>
         <Option name="pf_other_first">0</Option>
         <Option name="pf_other_multiple">0</Option>
         <Option name="pf_other_single">0</Option>
@@ -1004,9 +1022,9 @@
         <Option name="pf_udp_multiple">0</Option>
         <Option name="pf_udp_single">0</Option>
         <Option name="prolog_place">fw_file</Option>
-        <Option name="prolog_script"></Option>
-        <Option name="scpArgs"></Option>
-        <Option name="sshArgs"></Option>
+        <Option name="prolog_script"/>
+        <Option name="scpArgs"/>
+        <Option name="sshArgs"/>
       </FirewallOptions>
     </Firewall>
     <Cluster id="id3867X13237" host_OS="linux24" lastCompiled="0" lastInstalled="0" lastModified="0" platform="iptables" name="vrrp_cluster_2" comment="" ro="False">
@@ -1094,9 +1112,9 @@
           <Option name="iface_disablearp">False</Option>
           <Option name="iface_disableboot">False</Option>
           <Option name="iface_mtu">1500</Option>
-          <Option name="iface_options"></Option>
+          <Option name="iface_options"/>
           <Option name="type">ethernet</Option>
-          <Option name="vlan_id"></Option>
+          <Option name="vlan_id"/>
         </InterfaceOptions>
       </Interface>
       <Interface id="id4038X2906" dedicated_failover="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
@@ -1114,28 +1132,28 @@
       <FirewallOptions>
         <Option name="accept_established">True</Option>
         <Option name="accept_new_tcp_with_no_syn">True</Option>
-        <Option name="action_on_reject"></Option>
-        <Option name="activationCmd"></Option>
-        <Option name="admUser"></Option>
-        <Option name="altAddress"></Option>
+        <Option name="action_on_reject"/>
+        <Option name="activationCmd"/>
+        <Option name="admUser"/>
+        <Option name="altAddress"/>
         <Option name="bridging_fw">False</Option>
         <Option name="check_shading">False</Option>
         <Option name="clamp_mss_to_mtu">False</Option>
         <Option name="classify_mark_terminating">False</Option>
-        <Option name="cmdline"></Option>
-        <Option name="compiler"></Option>
+        <Option name="cmdline"/>
+        <Option name="compiler"/>
         <Option name="configure_interfaces">True</Option>
         <Option name="debug">False</Option>
         <Option name="drop_invalid">False</Option>
         <Option name="eliminate_duplicates">true</Option>
-        <Option name="epilog_script"></Option>
+        <Option name="epilog_script"/>
         <Option name="firewall_dir">/etc</Option>
         <Option name="firewall_is_part_of_any_and_networks">True</Option>
         <Option name="flush_and_set_default_policy">True</Option>
         <Option name="freebsd_ip_forward">1</Option>
         <Option name="ignore_empty_groups">False</Option>
         <Option name="ipv4_6_order">ipv4_first</Option>
-        <Option name="limit_suffix"></Option>
+        <Option name="limit_suffix"/>
         <Option name="limit_value">0</Option>
         <Option name="linux24_ip_forward">1</Option>
         <Option name="load_modules">True</Option>
@@ -1150,11 +1168,11 @@
         <Option name="loopback_interface">lo</Option>
         <Option name="macosx_ip_forward">1</Option>
         <Option name="manage_virtual_addr">True</Option>
-        <Option name="mgmt_addr"></Option>
+        <Option name="mgmt_addr"/>
         <Option name="mgmt_ssh">False</Option>
         <Option name="modules_dir">/lib/modules/`uname -r`/kernel/net/</Option>
         <Option name="openbsd_ip_forward">1</Option>
-        <Option name="output_file"></Option>
+        <Option name="output_file"/>
         <Option name="pf_limit_frags">5000</Option>
         <Option name="pf_limit_states">10000</Option>
         <Option name="pf_timeout_frag">30</Option>
@@ -1172,13 +1190,13 @@
         <Option name="pix_syslog_device_id_supported">false</Option>
         <Option name="pix_use_acl_remarks">true</Option>
         <Option name="prolog_place">top</Option>
-        <Option name="prolog_script"></Option>
-        <Option name="scpArgs"></Option>
+        <Option name="prolog_script"/>
+        <Option name="scpArgs"/>
         <Option name="secuwall_add_files">False</Option>
         <Option name="secuwall_add_files_dir">/opt/secuwall/templates/default</Option>
         <Option name="secuwall_dns_reso1">files</Option>
         <Option name="solaris_ip_forward">1</Option>
-        <Option name="sshArgs"></Option>
+        <Option name="sshArgs"/>
         <Option name="ulog_cprange">0</Option>
         <Option name="ulog_nlgroup">1</Option>
         <Option name="ulog_qthreshold">1</Option>
@@ -1225,9 +1243,9 @@
           <Option name="iface_disablearp">False</Option>
           <Option name="iface_disableboot">False</Option>
           <Option name="iface_mtu">1500</Option>
-          <Option name="iface_options"></Option>
+          <Option name="iface_options"/>
           <Option name="type">bonding</Option>
-          <Option name="vlan_id"></Option>
+          <Option name="vlan_id"/>
         </InterfaceOptions>
         <Interface id="id3807X49120" dedicated_failover="False" dyn="False" label="" security_level="0" unnum="False" unprotected="False" name="eth2" comment="" ro="False">
           <InterfaceOptions>
@@ -1250,28 +1268,28 @@
       <FirewallOptions>
         <Option name="accept_established">True</Option>
         <Option name="accept_new_tcp_with_no_syn">True</Option>
-        <Option name="action_on_reject"></Option>
-        <Option name="activationCmd"></Option>
-        <Option name="admUser"></Option>
-        <Option name="altAddress"></Option>
+        <Option name="action_on_reject"/>
+        <Option name="activationCmd"/>
+        <Option name="admUser"/>
+        <Option name="altAddress"/>
         <Option name="bridging_fw">False</Option>
         <Option name="check_shading">False</Option>
         <Option name="clamp_mss_to_mtu">False</Option>
         <Option name="classify_mark_terminating">False</Option>
-        <Option name="cmdline"></Option>
-        <Option name="compiler"></Option>
+        <Option name="cmdline"/>
+        <Option name="compiler"/>
         <Option name="configure_interfaces">True</Option>
         <Option name="debug">False</Option>
         <Option name="drop_invalid">False</Option>
         <Option name="eliminate_duplicates">true</Option>
-        <Option name="epilog_script"></Option>
+        <Option name="epilog_script"/>
         <Option name="firewall_dir">/etc</Option>
         <Option name="firewall_is_part_of_any_and_networks">True</Option>
         <Option name="flush_and_set_default_policy">True</Option>
         <Option name="freebsd_ip_forward">1</Option>
         <Option name="ignore_empty_groups">False</Option>
         <Option name="ipv4_6_order">ipv4_first</Option>
-        <Option name="limit_suffix"></Option>
+        <Option name="limit_suffix"/>
         <Option name="limit_value">0</Option>
         <Option name="linux24_ip_forward">1</Option>
         <Option name="load_modules">True</Option>
@@ -1286,11 +1304,11 @@
         <Option name="loopback_interface">lo</Option>
         <Option name="macosx_ip_forward">1</Option>
         <Option name="manage_virtual_addr">True</Option>
-        <Option name="mgmt_addr"></Option>
+        <Option name="mgmt_addr"/>
         <Option name="mgmt_ssh">False</Option>
         <Option name="modules_dir">/lib/modules/`uname -r`/kernel/net/</Option>
         <Option name="openbsd_ip_forward">1</Option>
-        <Option name="output_file"></Option>
+        <Option name="output_file"/>
         <Option name="pf_limit_frags">5000</Option>
         <Option name="pf_limit_states">10000</Option>
         <Option name="pf_timeout_frag">30</Option>
@@ -1308,13 +1326,13 @@
         <Option name="pix_syslog_device_id_supported">false</Option>
         <Option name="pix_use_acl_remarks">true</Option>
         <Option name="prolog_place">top</Option>
-        <Option name="prolog_script"></Option>
-        <Option name="scpArgs"></Option>
+        <Option name="prolog_script"/>
+        <Option name="scpArgs"/>
         <Option name="secuwall_add_files">False</Option>
         <Option name="secuwall_add_files_dir">/opt/secuwall/templates/default</Option>
         <Option name="secuwall_dns_reso1">files</Option>
         <Option name="solaris_ip_forward">1</Option>
-        <Option name="sshArgs"></Option>
+        <Option name="sshArgs"/>
         <Option name="ulog_cprange">0</Option>
         <Option name="ulog_nlgroup">1</Option>
         <Option name="ulog_qthreshold">1</Option>
@@ -1377,7 +1395,7 @@
         <InterfaceOptions>
           <Option name="bonding_mode">blance xor</Option>
           <Option name="bonding_policy">balance-xor</Option>
-          <Option name="bondng_driver_options"></Option>
+          <Option name="bondng_driver_options"/>
           <Option name="dev_plus_vid">False</Option>
           <Option name="dev_plus_vid_no_pad">False</Option>
           <Option name="enable_stp">True</Option>
@@ -1407,12 +1425,12 @@
         <Interface id="id6778X41225" dedicated_failover="False" dyn="False" label="" security_level="0" unnum="False" unprotected="False" name="bond1.123" comment="" ro="False">
           <IPv4 id="id16320X39036" name="linux-bonding-1:bond1:bond1.123:ip" comment="" ro="False" address="172.16.2.1" netmask="255.255.255.0"/>
           <InterfaceOptions>
-            <Option name="bonding_policy"></Option>
-            <Option name="bondng_driver_options"></Option>
+            <Option name="bonding_policy"/>
+            <Option name="bondng_driver_options"/>
             <Option name="enable_stp">False</Option>
             <Option name="type">8021q</Option>
             <Option name="vlan_id">123</Option>
-            <Option name="xmit_hash_policy"></Option>
+            <Option name="xmit_hash_policy"/>
           </InterfaceOptions>
         </Interface>
       </Interface>
@@ -1438,16 +1456,16 @@
       <FirewallOptions>
         <Option name="accept_established">True</Option>
         <Option name="accept_new_tcp_with_no_syn">True</Option>
-        <Option name="action_on_reject"></Option>
-        <Option name="activationCmd"></Option>
-        <Option name="admUser"></Option>
-        <Option name="altAddress"></Option>
+        <Option name="action_on_reject"/>
+        <Option name="activationCmd"/>
+        <Option name="admUser"/>
+        <Option name="altAddress"/>
         <Option name="bridging_fw">False</Option>
         <Option name="check_shading">False</Option>
         <Option name="clamp_mss_to_mtu">False</Option>
         <Option name="classify_mark_terminating">False</Option>
-        <Option name="cmdline"></Option>
-        <Option name="compiler"></Option>
+        <Option name="cmdline"/>
+        <Option name="compiler"/>
         <Option name="configure_bonding_interfaces">True</Option>
         <Option name="configure_bridge_interfaces">True</Option>
         <Option name="configure_interfaces">True</Option>
@@ -1455,14 +1473,14 @@
         <Option name="debug">False</Option>
         <Option name="drop_invalid">False</Option>
         <Option name="eliminate_duplicates">true</Option>
-        <Option name="epilog_script"></Option>
+        <Option name="epilog_script"/>
         <Option name="firewall_dir">/etc</Option>
         <Option name="firewall_is_part_of_any_and_networks">True</Option>
         <Option name="flush_and_set_default_policy">True</Option>
         <Option name="freebsd_ip_forward">1</Option>
         <Option name="ignore_empty_groups">False</Option>
         <Option name="ipv4_6_order">ipv4_first</Option>
-        <Option name="limit_suffix"></Option>
+        <Option name="limit_suffix"/>
         <Option name="limit_value">0</Option>
         <Option name="linux24_ip_forward">1</Option>
         <Option name="load_modules">True</Option>
@@ -1477,11 +1495,11 @@
         <Option name="loopback_interface">lo</Option>
         <Option name="macosx_ip_forward">1</Option>
         <Option name="manage_virtual_addr">True</Option>
-        <Option name="mgmt_addr"></Option>
+        <Option name="mgmt_addr"/>
         <Option name="mgmt_ssh">False</Option>
         <Option name="modules_dir">/lib/modules/`uname -r`/kernel/net/</Option>
         <Option name="openbsd_ip_forward">1</Option>
-        <Option name="output_file"></Option>
+        <Option name="output_file"/>
         <Option name="pf_limit_frags">5000</Option>
         <Option name="pf_limit_states">10000</Option>
         <Option name="pf_timeout_frag">30</Option>
@@ -1499,13 +1517,13 @@
         <Option name="pix_syslog_device_id_supported">false</Option>
         <Option name="pix_use_acl_remarks">true</Option>
         <Option name="prolog_place">top</Option>
-        <Option name="prolog_script"></Option>
-        <Option name="scpArgs"></Option>
+        <Option name="prolog_script"/>
+        <Option name="scpArgs"/>
         <Option name="secuwall_add_files">False</Option>
         <Option name="secuwall_add_files_dir">/opt/secuwall/templates/default</Option>
         <Option name="secuwall_dns_reso1">files</Option>
         <Option name="solaris_ip_forward">1</Option>
-        <Option name="sshArgs"></Option>
+        <Option name="sshArgs"/>
         <Option name="ulog_cprange">0</Option>
         <Option name="ulog_nlgroup">1</Option>
         <Option name="ulog_qthreshold">1</Option>
@@ -1547,26 +1565,29 @@
     <Cluster id="id3433X13311" host_OS="linux24" inactive="False" lastCompiled="1251482764" lastInstalled="0" lastModified="1253910805" platform="iptables" name="heartbeat_cluster_1" comment="This is an example of linux/heartbeat cluster with two policy rule sets. Branching rule in the top policy passes control to rule set to_fw, which is different in member firewalls.  See ticket #372 for explanation.&#10;" ro="False">
       <NAT id="id3587X13311" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
         <NATRule id="id3588X13311" disabled="False" position="0" action="Translate" comment="">
-          <OSrc neg="False">
+            <OSrc neg="False">
             <ObjectRef ref="id3DC75CE7-1"/>
           </OSrc>
-          <ODst neg="False">
+            <ODst neg="False">
             <ObjectRef ref="sysid0"/>
           </ODst>
-          <OSrv neg="False">
+            <OSrv neg="False">
             <ServiceRef ref="sysid1"/>
           </OSrv>
-          <TSrc neg="False">
+            <TSrc neg="False">
             <ObjectRef ref="sysid0"/>
           </TSrc>
-          <TDst neg="False">
+            <TDst neg="False">
             <ObjectRef ref="sysid0"/>
           </TDst>
-          <TSrv neg="False">
+            <TSrv neg="False">
             <ServiceRef ref="sysid1"/>
           </TSrv>
-          <NATRuleOptions/>
-        </NATRule>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
+            <NATRuleOptions/>
+          </NATRule>
         <RuleSetOptions/>
       </NAT>
       <Policy id="id3465X13311" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
@@ -1698,12 +1719,12 @@
             <IntervalRef ref="sysid2"/>
           </When>
           <PolicyRuleOptions>
-            <Option name="action_on_reject"></Option>
+            <Option name="action_on_reject"/>
             <Option name="branch_id">id6187X76214</Option>
-            <Option name="classify_str"></Option>
+            <Option name="classify_str"/>
             <Option name="connlimit_masklen">0</Option>
             <Option name="connlimit_value">0</Option>
-            <Option name="custom_str"></Option>
+            <Option name="custom_str"/>
             <Option name="firewall_is_part_of_any_and_networks">False</Option>
             <Option name="hashlimit_burst">0</Option>
             <Option name="hashlimit_dstlimit">False</Option>
@@ -1714,34 +1735,34 @@
             <Option name="hashlimit_mode_dstport">False</Option>
             <Option name="hashlimit_mode_srcip">False</Option>
             <Option name="hashlimit_mode_srcport">False</Option>
-            <Option name="hashlimit_name"></Option>
+            <Option name="hashlimit_name"/>
             <Option name="hashlimit_size">0</Option>
-            <Option name="hashlimit_suffix"></Option>
+            <Option name="hashlimit_suffix"/>
             <Option name="hashlimit_value">0</Option>
-            <Option name="ipf_route_opt_addr"></Option>
-            <Option name="ipf_route_opt_if"></Option>
+            <Option name="ipf_route_opt_addr"/>
+            <Option name="ipf_route_opt_if"/>
             <Option name="ipf_route_option">route_through</Option>
             <Option name="ipfw_classify_method">2</Option>
             <Option name="ipfw_pipe_port_num">0</Option>
             <Option name="ipfw_pipe_queue_num">0</Option>
             <Option name="ipt_branch_in_mangle">False</Option>
             <Option name="ipt_continue">False</Option>
-            <Option name="ipt_gw"></Option>
-            <Option name="ipt_iif"></Option>
+            <Option name="ipt_gw"/>
+            <Option name="ipt_iif"/>
             <Option name="ipt_mark_connections">False</Option>
-            <Option name="ipt_oif"></Option>
+            <Option name="ipt_oif"/>
             <Option name="ipt_tee">False</Option>
             <Option name="limit_burst">0</Option>
-            <Option name="limit_suffix"></Option>
+            <Option name="limit_suffix"/>
             <Option name="limit_value">0</Option>
-            <Option name="log_level"></Option>
-            <Option name="log_prefix"></Option>
+            <Option name="log_level"/>
+            <Option name="log_prefix"/>
             <Option name="pf_fastroute">False</Option>
             <Option name="pf_route_load_option">none</Option>
-            <Option name="pf_route_opt_addr"></Option>
-            <Option name="pf_route_opt_if"></Option>
+            <Option name="pf_route_opt_addr"/>
+            <Option name="pf_route_opt_if"/>
             <Option name="pf_route_option">none</Option>
-            <Option name="rule_name_accounting"></Option>
+            <Option name="rule_name_accounting"/>
             <Option name="stateless">True</Option>
             <Option name="ulog_nlgroup">1</Option>
           </PolicyRuleOptions>
@@ -1775,15 +1796,15 @@
             <Option name="hashlimit_mode_dstport">False</Option>
             <Option name="hashlimit_mode_srcip">False</Option>
             <Option name="hashlimit_mode_srcport">False</Option>
-            <Option name="hashlimit_name"></Option>
+            <Option name="hashlimit_name"/>
             <Option name="hashlimit_size">0</Option>
-            <Option name="hashlimit_suffix"></Option>
+            <Option name="hashlimit_suffix"/>
             <Option name="hashlimit_value">0</Option>
             <Option name="limit_burst">0</Option>
-            <Option name="limit_suffix"></Option>
+            <Option name="limit_suffix"/>
             <Option name="limit_value">0</Option>
-            <Option name="log_level"></Option>
-            <Option name="log_prefix"></Option>
+            <Option name="log_level"/>
+            <Option name="log_prefix"/>
             <Option name="stateless">True</Option>
             <Option name="ulog_nlgroup">1</Option>
           </PolicyRuleOptions>
@@ -1897,7 +1918,7 @@
         </FailoverClusterGroup>
       </Interface>
       <FirewallOptions>
-        <Option name="ipt_mangle_only_rulesets"></Option>
+        <Option name="ipt_mangle_only_rulesets"/>
       </FirewallOptions>
       <StateSyncClusterGroup id="id3604X13311" master_iface="id2843X69605" type="conntrack" name="State Sync Group" comment="">
         <ObjectRef ref="id2843X69605"/>
@@ -1911,26 +1932,29 @@
     <Cluster id="id4400X28690" host_OS="linux24" inactive="False" lastCompiled="1248555910" lastInstalled="0" lastModified="1253911350" platform="iptables" name="openais_cluster_1" comment="" ro="False">
       <NAT id="id4568X28690" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
         <NATRule id="id4569X28690" disabled="False" position="0" action="Translate" comment="">
-          <OSrc neg="False">
+            <OSrc neg="False">
             <ObjectRef ref="id3DC75CE7-1"/>
           </OSrc>
-          <ODst neg="False">
+            <ODst neg="False">
             <ObjectRef ref="sysid0"/>
           </ODst>
-          <OSrv neg="False">
+            <OSrv neg="False">
             <ServiceRef ref="sysid1"/>
           </OSrv>
-          <TSrc neg="False">
+            <TSrc neg="False">
             <ObjectRef ref="sysid0"/>
           </TSrc>
-          <TDst neg="False">
+            <TDst neg="False">
             <ObjectRef ref="sysid0"/>
           </TDst>
-          <TSrv neg="False">
+            <TSrv neg="False">
             <ServiceRef ref="sysid1"/>
           </TSrv>
-          <NATRuleOptions/>
-        </NATRule>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
+            <NATRuleOptions/>
+          </NATRule>
         <RuleSetOptions/>
       </NAT>
       <Policy id="id4434X28690" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
@@ -2074,15 +2098,15 @@
             <Option name="hashlimit_mode_dstport">False</Option>
             <Option name="hashlimit_mode_srcip">False</Option>
             <Option name="hashlimit_mode_srcport">False</Option>
-            <Option name="hashlimit_name"></Option>
+            <Option name="hashlimit_name"/>
             <Option name="hashlimit_size">0</Option>
-            <Option name="hashlimit_suffix"></Option>
+            <Option name="hashlimit_suffix"/>
             <Option name="hashlimit_value">0</Option>
             <Option name="limit_burst">0</Option>
-            <Option name="limit_suffix"></Option>
+            <Option name="limit_suffix"/>
             <Option name="limit_value">0</Option>
-            <Option name="log_level"></Option>
-            <Option name="log_prefix"></Option>
+            <Option name="log_level"/>
+            <Option name="log_prefix"/>
             <Option name="stateless">True</Option>
             <Option name="ulog_nlgroup">1</Option>
           </PolicyRuleOptions>
@@ -2116,15 +2140,15 @@
             <Option name="hashlimit_mode_dstport">False</Option>
             <Option name="hashlimit_mode_srcip">False</Option>
             <Option name="hashlimit_mode_srcport">False</Option>
-            <Option name="hashlimit_name"></Option>
+            <Option name="hashlimit_name"/>
             <Option name="hashlimit_size">0</Option>
-            <Option name="hashlimit_suffix"></Option>
+            <Option name="hashlimit_suffix"/>
             <Option name="hashlimit_value">0</Option>
             <Option name="limit_burst">0</Option>
-            <Option name="limit_suffix"></Option>
+            <Option name="limit_suffix"/>
             <Option name="limit_value">0</Option>
-            <Option name="log_level"></Option>
-            <Option name="log_prefix"></Option>
+            <Option name="log_level"/>
+            <Option name="log_prefix"/>
             <Option name="stateless">True</Option>
             <Option name="ulog_nlgroup">1</Option>
           </PolicyRuleOptions>
@@ -2261,26 +2285,29 @@
     <Cluster id="id2772X94039" host_OS="linux24" inactive="False" lastCompiled="1248541095" lastInstalled="0" lastModified="1253911174" platform="iptables" name="vrrp_cluster_1" comment="" ro="False">
       <NAT id="id2866X94039" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
         <NATRule id="id2867X94039" disabled="False" position="0" action="Translate" comment="">
-          <OSrc neg="False">
+            <OSrc neg="False">
             <ObjectRef ref="id3DC75CE7-1"/>
           </OSrc>
-          <ODst neg="False">
+            <ODst neg="False">
             <ObjectRef ref="sysid0"/>
           </ODst>
-          <OSrv neg="False">
+            <OSrv neg="False">
             <ServiceRef ref="sysid1"/>
           </OSrv>
-          <TSrc neg="False">
+            <TSrc neg="False">
             <ObjectRef ref="sysid0"/>
           </TSrc>
-          <TDst neg="False">
+            <TDst neg="False">
             <ObjectRef ref="sysid0"/>
           </TDst>
-          <TSrv neg="False">
+            <TSrv neg="False">
             <ServiceRef ref="sysid1"/>
           </TSrv>
-          <NATRuleOptions/>
-        </NATRule>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
+            <NATRuleOptions/>
+          </NATRule>
         <RuleSetOptions/>
       </NAT>
       <Policy id="id2780X94039" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
@@ -2424,15 +2451,15 @@
             <Option name="hashlimit_mode_dstport">False</Option>
             <Option name="hashlimit_mode_srcip">False</Option>
             <Option name="hashlimit_mode_srcport">False</Option>
-            <Option name="hashlimit_name"></Option>
+            <Option name="hashlimit_name"/>
             <Option name="hashlimit_size">0</Option>
-            <Option name="hashlimit_suffix"></Option>
+            <Option name="hashlimit_suffix"/>
             <Option name="hashlimit_value">0</Option>
             <Option name="limit_burst">0</Option>
-            <Option name="limit_suffix"></Option>
+            <Option name="limit_suffix"/>
             <Option name="limit_value">0</Option>
-            <Option name="log_level"></Option>
-            <Option name="log_prefix"></Option>
+            <Option name="log_level"/>
+            <Option name="log_prefix"/>
             <Option name="stateless">True</Option>
             <Option name="ulog_nlgroup">1</Option>
           </PolicyRuleOptions>
@@ -2558,26 +2585,29 @@
     <Cluster id="id3937X13563" host_OS="linux24" lastCompiled="1248541096" lastInstalled="0" lastModified="1251419063" platform="iptables" name="vrrp_cluster_2" comment="" ro="False">
       <NAT id="id3941X13563" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
         <NATRule id="id5083X25627" disabled="False" position="0" action="Translate" comment="">
-          <OSrc neg="False">
+            <OSrc neg="False">
             <ObjectRef ref="id3DC75CE7-1"/>
           </OSrc>
-          <ODst neg="False">
+            <ODst neg="False">
             <ObjectRef ref="sysid0"/>
           </ODst>
-          <OSrv neg="False">
+            <OSrv neg="False">
             <ServiceRef ref="sysid1"/>
           </OSrv>
-          <TSrc neg="False">
+            <TSrc neg="False">
             <ObjectRef ref="sysid0"/>
           </TSrc>
-          <TDst neg="False">
+            <TDst neg="False">
             <ObjectRef ref="sysid0"/>
           </TDst>
-          <TSrv neg="False">
+            <TSrv neg="False">
             <ServiceRef ref="sysid1"/>
           </TSrv>
-          <NATRuleOptions/>
-        </NATRule>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
+            <NATRuleOptions/>
+          </NATRule>
         <RuleSetOptions/>
       </NAT>
       <Policy id="id3940X13563" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
@@ -2721,15 +2751,15 @@
             <Option name="hashlimit_mode_dstport">False</Option>
             <Option name="hashlimit_mode_srcip">False</Option>
             <Option name="hashlimit_mode_srcport">False</Option>
-            <Option name="hashlimit_name"></Option>
+            <Option name="hashlimit_name"/>
             <Option name="hashlimit_size">0</Option>
-            <Option name="hashlimit_suffix"></Option>
+            <Option name="hashlimit_suffix"/>
             <Option name="hashlimit_value">0</Option>
             <Option name="limit_burst">0</Option>
-            <Option name="limit_suffix"></Option>
+            <Option name="limit_suffix"/>
             <Option name="limit_value">0</Option>
-            <Option name="log_level"></Option>
-            <Option name="log_prefix"></Option>
+            <Option name="log_level"/>
+            <Option name="log_prefix"/>
             <Option name="stateless">True</Option>
             <Option name="ulog_nlgroup">1</Option>
           </PolicyRuleOptions>
@@ -2901,16 +2931,16 @@
       <FirewallOptions>
         <Option name="accept_established">True</Option>
         <Option name="accept_new_tcp_with_no_syn">True</Option>
-        <Option name="action_on_reject"></Option>
-        <Option name="activationCmd"></Option>
-        <Option name="admUser"></Option>
-        <Option name="altAddress"></Option>
+        <Option name="action_on_reject"/>
+        <Option name="activationCmd"/>
+        <Option name="admUser"/>
+        <Option name="altAddress"/>
         <Option name="bridging_fw">False</Option>
         <Option name="check_shading">False</Option>
         <Option name="clamp_mss_to_mtu">False</Option>
         <Option name="classify_mark_terminating">False</Option>
-        <Option name="cmdline"></Option>
-        <Option name="compiler"></Option>
+        <Option name="cmdline"/>
+        <Option name="compiler"/>
         <Option name="configure_bonding_interfaces">True</Option>
         <Option name="configure_bridge_interfaces">True</Option>
         <Option name="configure_interfaces">True</Option>
@@ -2918,14 +2948,14 @@
         <Option name="debug">False</Option>
         <Option name="drop_invalid">False</Option>
         <Option name="eliminate_duplicates">true</Option>
-        <Option name="epilog_script"></Option>
+        <Option name="epilog_script"/>
         <Option name="firewall_dir">/etc</Option>
         <Option name="firewall_is_part_of_any_and_networks">True</Option>
         <Option name="flush_and_set_default_policy">True</Option>
         <Option name="freebsd_ip_forward">1</Option>
         <Option name="ignore_empty_groups">False</Option>
         <Option name="ipv4_6_order">ipv4_first</Option>
-        <Option name="limit_suffix"></Option>
+        <Option name="limit_suffix"/>
         <Option name="limit_value">0</Option>
         <Option name="linux24_ip_forward">1</Option>
         <Option name="load_modules">True</Option>
@@ -2940,11 +2970,11 @@
         <Option name="loopback_interface">lo</Option>
         <Option name="macosx_ip_forward">1</Option>
         <Option name="manage_virtual_addr">True</Option>
-        <Option name="mgmt_addr"></Option>
+        <Option name="mgmt_addr"/>
         <Option name="mgmt_ssh">False</Option>
         <Option name="modules_dir">/lib/modules/`uname -r`/kernel/net/</Option>
         <Option name="openbsd_ip_forward">1</Option>
-        <Option name="output_file"></Option>
+        <Option name="output_file"/>
         <Option name="pf_limit_frags">5000</Option>
         <Option name="pf_limit_states">10000</Option>
         <Option name="pf_timeout_frag">30</Option>
@@ -2962,13 +2992,13 @@
         <Option name="pix_syslog_device_id_supported">false</Option>
         <Option name="pix_use_acl_remarks">true</Option>
         <Option name="prolog_place">top</Option>
-        <Option name="prolog_script"></Option>
-        <Option name="scpArgs"></Option>
+        <Option name="prolog_script"/>
+        <Option name="scpArgs"/>
         <Option name="secuwall_add_files">False</Option>
         <Option name="secuwall_add_files_dir">/opt/secuwall/templates/default</Option>
         <Option name="secuwall_dns_reso1">files</Option>
         <Option name="solaris_ip_forward">1</Option>
-        <Option name="sshArgs"></Option>
+        <Option name="sshArgs"/>
         <Option name="ulog_cprange">0</Option>
         <Option name="ulog_nlgroup">1</Option>
         <Option name="ulog_qthreshold">1</Option>
@@ -3007,6 +3037,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -3248,15 +3281,15 @@
               <Option name="hashlimit_mode_dstport">False</Option>
               <Option name="hashlimit_mode_srcip">False</Option>
               <Option name="hashlimit_mode_srcport">False</Option>
-              <Option name="hashlimit_name"></Option>
+              <Option name="hashlimit_name"/>
               <Option name="hashlimit_size">0</Option>
               <Option name="hashlimit_suffix">/second</Option>
               <Option name="hashlimit_value">10</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"></Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_level"/>
+              <Option name="log_prefix"/>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
@@ -3298,16 +3331,16 @@
         <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
-          <Option name="action_on_reject"></Option>
-          <Option name="activationCmd"></Option>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="action_on_reject"/>
+          <Option name="activationCmd"/>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="classify_mark_terminating">False</Option>
-          <Option name="cmdline"></Option>
-          <Option name="compiler"></Option>
+          <Option name="cmdline"/>
+          <Option name="compiler"/>
           <Option name="configure_interfaces">True</Option>
           <Option name="configure_vlan_interfaces">True</Option>
           <Option name="ctiqbe_fixup">2 2748 0 nil 0</Option>
@@ -3315,7 +3348,7 @@
           <Option name="dns_fixup">2 65535 0 nil 0</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="eliminate_duplicates">true</Option>
-          <Option name="epilog_script"></Option>
+          <Option name="epilog_script"/>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
@@ -3331,9 +3364,9 @@
           <Option name="iosacl_add_clear_statements">true</Option>
           <Option name="iosacl_assume_fw_part_of_any">true</Option>
           <Option name="iosacl_include_comments">true</Option>
-          <Option name="ipt_mangle_only_rulesets"></Option>
+          <Option name="ipt_mangle_only_rulesets"/>
           <Option name="ipv4_6_order">ipv4_first</Option>
-          <Option name="limit_suffix"></Option>
+          <Option name="limit_suffix"/>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">1</Option>
           <Option name="load_modules">True</Option>
@@ -3349,11 +3382,11 @@
           <Option name="macosx_ip_forward">1</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"></Option>
+          <Option name="mgmt_addr"/>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modules_dir">/lib/modules/`uname -r`/kernel/net/</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
           <Option name="pf_timeout_frag">30</Option>
@@ -3373,10 +3406,10 @@
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="pptp_fixup">2 1723 0 nil 0</Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"></Option>
+          <Option name="prolog_script"/>
           <Option name="rsh_fixup">2 514 0 nil 0</Option>
           <Option name="rtsp_fixup">2 554 0 nil 0</Option>
-          <Option name="scpArgs"></Option>
+          <Option name="scpArgs"/>
           <Option name="secuwall_add_files">False</Option>
           <Option name="secuwall_add_files_dir">/opt/secuwall/templates/default</Option>
           <Option name="secuwall_dns_reso1">files</Option>
@@ -3386,7 +3419,7 @@
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
           <Option name="solaris_ip_forward">1</Option>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
@@ -3434,15 +3467,15 @@
               <Option name="hashlimit_mode_dstport">False</Option>
               <Option name="hashlimit_mode_srcip">False</Option>
               <Option name="hashlimit_mode_srcport">False</Option>
-              <Option name="hashlimit_name"></Option>
+              <Option name="hashlimit_name"/>
               <Option name="hashlimit_size">0</Option>
               <Option name="hashlimit_suffix">/second</Option>
               <Option name="hashlimit_value">20</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"></Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_level"/>
+              <Option name="log_prefix"/>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
@@ -3472,21 +3505,21 @@
         <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
-          <Option name="action_on_reject"></Option>
-          <Option name="activationCmd"></Option>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="action_on_reject"/>
+          <Option name="activationCmd"/>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="classify_mark_terminating">False</Option>
-          <Option name="cmdline"></Option>
-          <Option name="compiler"></Option>
+          <Option name="cmdline"/>
+          <Option name="compiler"/>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="eliminate_duplicates">true</Option>
-          <Option name="epilog_script"></Option>
+          <Option name="epilog_script"/>
           <Option name="firewall_dir">/etc</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="flush_and_set_default_policy">True</Option>
@@ -3495,9 +3528,9 @@
           <Option name="iosacl_add_clear_statements">true</Option>
           <Option name="iosacl_assume_fw_part_of_any">true</Option>
           <Option name="iosacl_include_comments">true</Option>
-          <Option name="ipt_mangle_only_rulesets"></Option>
+          <Option name="ipt_mangle_only_rulesets"/>
           <Option name="ipv4_6_order">ipv4_first</Option>
-          <Option name="limit_suffix"></Option>
+          <Option name="limit_suffix"/>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">1</Option>
           <Option name="load_modules">True</Option>
@@ -3512,11 +3545,11 @@
           <Option name="loopback_interface">lo</Option>
           <Option name="macosx_ip_forward">1</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="mgmt_addr"></Option>
+          <Option name="mgmt_addr"/>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modules_dir">/lib/modules/`uname -r`/kernel/net/</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
           <Option name="pf_timeout_frag">30</Option>
@@ -3534,13 +3567,13 @@
           <Option name="pix_syslog_device_id_supported">false</Option>
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"></Option>
-          <Option name="scpArgs"></Option>
+          <Option name="prolog_script"/>
+          <Option name="scpArgs"/>
           <Option name="secuwall_add_files">False</Option>
           <Option name="secuwall_add_files_dir">/opt/secuwall/templates/default</Option>
           <Option name="secuwall_dns_reso1">files</Option>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
diff --git a/test/iosacl/objects-for-regression-tests.fwb b/test/iosacl/objects-for-regression-tests.fwb
index a7c1d08f5..bc9d4ee99 100644
--- a/test/iosacl/objects-for-regression-tests.fwb
+++ b/test/iosacl/objects-for-regression-tests.fwb
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
-<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="17" lastModified="1269897518" id="root">
+<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="18" lastModified="1269897518" id="root">
   <Library id="syslib000" color="#d4f8ff" name="Standard" comment="Standard objects" ro="True">
     <AnyNetwork id="sysid0" name="Any" comment="Any Network" ro="False" address="0.0.0.0" netmask="0.0.0.0"/>
     <AnyIPService id="sysid1" protocol_num="0" name="Any" comment="Any IP Service" ro="False"/>
@@ -51,9 +51,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"></Option>
-            <Option name="snmp_description"></Option>
-            <Option name="snmp_location"></Option>
+            <Option name="snmp_contact"/>
+            <Option name="snmp_description"/>
+            <Option name="snmp_location"/>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -69,9 +69,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"></Option>
-            <Option name="snmp_description"></Option>
-            <Option name="snmp_location"></Option>
+            <Option name="snmp_contact"/>
+            <Option name="snmp_description"/>
+            <Option name="snmp_location"/>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -100,17 +100,17 @@
     </ObjectGroup>
     <ServiceGroup id="stdid05" name="Services" comment="" ro="False">
       <CustomService id="stdid14_1" name="ESTABLISHED" comment="This service matches all packets which are part of network connections established through the firewall, or connections 'related' to those established through the firewall. Term 'established' refers to the state tracking mechanism which exists inside iptables and other stateful firewalls and does not mean any particular combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful inspection module made appropriate record in the state table. Usually stateful firewalls keep track of network connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' describes packet belonging to a separate network connection, related to the session firewall is keeping track of. One example is FTP command and FTP data sessions." ro="False" protocol="any" address_family="ipv4">
-        <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+        <CustomServiceCommand platform="Undefined"/>
         <CustomServiceCommand platform="iosacl">established</CustomServiceCommand>
-        <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+        <CustomServiceCommand platform="ipfilter"/>
         <CustomServiceCommand platform="ipfw">established</CustomServiceCommand>
         <CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
         <CustomServiceCommand platform="procurve_acl">established</CustomServiceCommand>
       </CustomService>
       <CustomService id="stdid14_2" name="ESTABLISHED ipv6" comment="This service matches all packets which are part of network connections established through the firewall, or connections 'related' to those established through the firewall. Term 'established' refers to the state tracking mechanism which exists inside iptables and other stateful firewalls and does not mean any particular combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful inspection module made appropriate record in the state table. Usually stateful firewalls keep track of network connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' describes packet belonging to a separate network connection, related to the session firewall is keeping track of. One example is FTP command and FTP data sessions." ro="False" protocol="any" address_family="ipv6">
-        <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+        <CustomServiceCommand platform="Undefined"/>
         <CustomServiceCommand platform="iosacl">established</CustomServiceCommand>
-        <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+        <CustomServiceCommand platform="ipfilter"/>
         <CustomServiceCommand platform="ipfw">established</CustomServiceCommand>
         <CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
         <CustomServiceCommand platform="procurve_acl">established</CustomServiceCommand>
@@ -359,54 +359,54 @@
       </ServiceGroup>
       <ServiceGroup id="stdid13" name="Custom" comment="" ro="False">
         <CustomService id="id3B64EEA8" name="rpc" comment="works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
+          <CustomServiceCommand platform="Undefined"/>
+          <CustomServiceCommand platform="ipf"/>
+          <CustomServiceCommand platform="ipfilter"/>
+          <CustomServiceCommand platform="ipfw"/>
           <CustomServiceCommand platform="iptables">-m record_rpc</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"></CustomServiceCommand>
-          <CustomServiceCommand platform="pix"></CustomServiceCommand>
-          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
+          <CustomServiceCommand platform="pf"/>
+          <CustomServiceCommand platform="pix"/>
+          <CustomServiceCommand platform="unknown"/>
         </CustomService>
         <CustomService id="id3B64EF4E" name="irc-conn" comment="IRC connection tracker, supports DCC.&#10;Works on iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/&#10;" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
+          <CustomServiceCommand platform="Undefined"/>
+          <CustomServiceCommand platform="ipf"/>
+          <CustomServiceCommand platform="ipfilter"/>
+          <CustomServiceCommand platform="ipfw"/>
           <CustomServiceCommand platform="iptables">-m irc</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"></CustomServiceCommand>
-          <CustomServiceCommand platform="pix"></CustomServiceCommand>
-          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
+          <CustomServiceCommand platform="pf"/>
+          <CustomServiceCommand platform="pix"/>
+          <CustomServiceCommand platform="unknown"/>
         </CustomService>
         <CustomService id="id3B64EF50" name="psd" comment="Port scan detector, works only on iptables and  requires patch-o-matic &#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
+          <CustomServiceCommand platform="Undefined"/>
+          <CustomServiceCommand platform="ipf"/>
+          <CustomServiceCommand platform="ipfilter"/>
+          <CustomServiceCommand platform="ipfw"/>
           <CustomServiceCommand platform="iptables">-m psd --psd-weight-threshold 5 --psd-delay-threshold 10000</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"></CustomServiceCommand>
-          <CustomServiceCommand platform="pix"></CustomServiceCommand>
-          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
+          <CustomServiceCommand platform="pf"/>
+          <CustomServiceCommand platform="pix"/>
+          <CustomServiceCommand platform="unknown"/>
         </CustomService>
         <CustomService id="id3B64EF52" name="string" comment="Matches a string in a whole packet, works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
+          <CustomServiceCommand platform="Undefined"/>
+          <CustomServiceCommand platform="ipf"/>
+          <CustomServiceCommand platform="ipfilter"/>
+          <CustomServiceCommand platform="ipfw"/>
           <CustomServiceCommand platform="iptables">-m string --string test_pattern</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"></CustomServiceCommand>
-          <CustomServiceCommand platform="pix"></CustomServiceCommand>
-          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
+          <CustomServiceCommand platform="pf"/>
+          <CustomServiceCommand platform="pix"/>
+          <CustomServiceCommand platform="unknown"/>
         </CustomService>
         <CustomService id="id3B64EF54" name="talk" comment="Talk protocol support. Works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
+          <CustomServiceCommand platform="Undefined"/>
+          <CustomServiceCommand platform="ipf"/>
+          <CustomServiceCommand platform="ipfilter"/>
+          <CustomServiceCommand platform="ipfw"/>
           <CustomServiceCommand platform="iptables">-m talk</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"></CustomServiceCommand>
-          <CustomServiceCommand platform="pix"></CustomServiceCommand>
-          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
+          <CustomServiceCommand platform="pf"/>
+          <CustomServiceCommand platform="pix"/>
+          <CustomServiceCommand platform="unknown"/>
         </CustomService>
       </ServiceGroup>
       <ServiceGroup id="stdid19" name="TagServices" comment="" ro="False"/>
@@ -588,34 +588,34 @@
       <ServiceGroup id="id4511637123682" name="UDP" comment="" ro="False"/>
       <ServiceGroup id="id4511637223682" name="Custom" comment="" ro="False">
         <CustomService id="id4226X64279" name="dscp af11" comment="" ro="False" protocol="tcp" address_family="ipv4">
-          <CustomServiceCommand platform="fwsm"></CustomServiceCommand>
+          <CustomServiceCommand platform="fwsm"/>
           <CustomServiceCommand platform="iosacl">dscp af11</CustomServiceCommand>
-          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
-          <CustomServiceCommand platform="iptables"></CustomServiceCommand>
-          <CustomServiceCommand platform="pf"></CustomServiceCommand>
-          <CustomServiceCommand platform="pix"></CustomServiceCommand>
-          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"/>
+          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="iptables"/>
+          <CustomServiceCommand platform="pf"/>
+          <CustomServiceCommand platform="pix"/>
+          <CustomServiceCommand platform="unknown"/>
         </CustomService>
         <CustomService id="id8888X64279" name="esp dscp af12" comment="" ro="False" protocol="50" address_family="ipv4">
-          <CustomServiceCommand platform="fwsm"></CustomServiceCommand>
+          <CustomServiceCommand platform="fwsm"/>
           <CustomServiceCommand platform="iosacl">dscp af12</CustomServiceCommand>
-          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
-          <CustomServiceCommand platform="iptables"></CustomServiceCommand>
-          <CustomServiceCommand platform="pf"></CustomServiceCommand>
-          <CustomServiceCommand platform="pix"></CustomServiceCommand>
-          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"/>
+          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="iptables"/>
+          <CustomServiceCommand platform="pf"/>
+          <CustomServiceCommand platform="pix"/>
+          <CustomServiceCommand platform="unknown"/>
         </CustomService>
         <CustomService id="id26068X65694" name="esp dscp af11 ipv6" comment="" ro="False" protocol="50" address_family="ipv6">
-          <CustomServiceCommand platform="fwsm"></CustomServiceCommand>
+          <CustomServiceCommand platform="fwsm"/>
           <CustomServiceCommand platform="iosacl">dscp af11</CustomServiceCommand>
-          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
-          <CustomServiceCommand platform="iptables"></CustomServiceCommand>
-          <CustomServiceCommand platform="pf"></CustomServiceCommand>
-          <CustomServiceCommand platform="pix"></CustomServiceCommand>
-          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"/>
+          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="iptables"/>
+          <CustomServiceCommand platform="pf"/>
+          <CustomServiceCommand platform="pix"/>
+          <CustomServiceCommand platform="unknown"/>
         </CustomService>
       </ServiceGroup>
       <ServiceGroup id="id4511637323682" name="TagServices" comment="" ro="False"/>
@@ -1134,10 +1134,10 @@
           <Option name="accept_established">true</Option>
           <Option name="accept_new_tcp_with_no_syn">true</Option>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="check_shading">False</Option>
-          <Option name="compiler"></Option>
+          <Option name="compiler"/>
           <Option name="configure_interfaces">true</Option>
           <Option name="eliminate_duplicates">true</Option>
           <Option name="filesystem">/etc</Option>
@@ -1166,8 +1166,8 @@
           <Option name="iosacl_logging_trap_level">3</Option>
           <Option name="iosacl_prolog_script">! This is prolog</Option>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"></Option>
-          <Option name="iosacl_syslog_host"></Option>
+          <Option name="iosacl_syslog_facility"/>
+          <Option name="iosacl_syslog_host"/>
           <Option name="iosacl_use_acl_remarks">False</Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
           <Option name="limit_value">0</Option>
@@ -1182,7 +1182,7 @@
           <Option name="mgmt_addr">1.1.1.100</Option>
           <Option name="mgmt_ssh">True</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="pass_all_out">false</Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
@@ -1203,9 +1203,9 @@
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
-          <Option name="scpArgs"></Option>
+          <Option name="scpArgs"/>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="use_scp">False</Option>
           <Option name="verify_interfaces">true</Option>
@@ -1592,10 +1592,10 @@
           <Option name="accept_established">true</Option>
           <Option name="accept_new_tcp_with_no_syn">true</Option>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="check_shading">False</Option>
-          <Option name="compiler"></Option>
+          <Option name="compiler"/>
           <Option name="configure_interfaces">true</Option>
           <Option name="eliminate_duplicates">true</Option>
           <Option name="firewall_dir">/etc</Option>
@@ -1608,21 +1608,21 @@
           <Option name="iosacl_acl_basic">True</Option>
           <Option name="iosacl_acl_no_clear">False</Option>
           <Option name="iosacl_acl_substitution">False</Option>
-          <Option name="iosacl_acl_temp_addr"></Option>
+          <Option name="iosacl_acl_temp_addr"/>
           <Option name="iosacl_add_clear_statements">true</Option>
           <Option name="iosacl_assume_fw_part_of_any">true</Option>
-          <Option name="iosacl_epilog_script"></Option>
+          <Option name="iosacl_epilog_script"/>
           <Option name="iosacl_include_comments">True</Option>
           <Option name="iosacl_logging_buffered">False</Option>
-          <Option name="iosacl_logging_buffered_level"></Option>
+          <Option name="iosacl_logging_buffered_level"/>
           <Option name="iosacl_logging_console">False</Option>
-          <Option name="iosacl_logging_console_level"></Option>
+          <Option name="iosacl_logging_console_level"/>
           <Option name="iosacl_logging_timestamp">False</Option>
-          <Option name="iosacl_logging_trap_level"></Option>
-          <Option name="iosacl_prolog_script"></Option>
+          <Option name="iosacl_logging_trap_level"/>
+          <Option name="iosacl_prolog_script"/>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"></Option>
-          <Option name="iosacl_syslog_host"></Option>
+          <Option name="iosacl_syslog_facility"/>
+          <Option name="iosacl_syslog_host"/>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">1</Option>
           <Option name="load_modules">true</Option>
@@ -1632,10 +1632,10 @@
           <Option name="loopback_interface">lo0</Option>
           <Option name="macosx_ip_forward">1</Option>
           <Option name="manage_virtual_addr">true</Option>
-          <Option name="mgmt_addr"></Option>
+          <Option name="mgmt_addr"/>
           <Option name="mgmt_ssh">False</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="pass_all_out">false</Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
@@ -1657,7 +1657,7 @@
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="verify_interfaces">true</Option>
         </FirewallOptions>
@@ -2131,8 +2131,8 @@
           <Option name="accept_established">true</Option>
           <Option name="accept_new_tcp_with_no_syn">true</Option>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="check_shading">False</Option>
           <Option name="configure_interfaces">true</Option>
           <Option name="eliminate_duplicates">true</Option>
@@ -2150,7 +2150,7 @@
           <Option name="iosacl_acl_temp_addr">10.10.10.0/24</Option>
           <Option name="iosacl_add_clear_statements">true</Option>
           <Option name="iosacl_assume_fw_part_of_any">true</Option>
-          <Option name="iosacl_epilog_script"></Option>
+          <Option name="iosacl_epilog_script"/>
           <Option name="iosacl_generate_logging_commands">False</Option>
           <Option name="iosacl_include_comments">True</Option>
           <Option name="iosacl_logging_buffered">False</Option>
@@ -2159,10 +2159,10 @@
           <Option name="iosacl_logging_console_level">3</Option>
           <Option name="iosacl_logging_timestamp">False</Option>
           <Option name="iosacl_logging_trap_level">3</Option>
-          <Option name="iosacl_prolog_script"></Option>
+          <Option name="iosacl_prolog_script"/>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"></Option>
-          <Option name="iosacl_syslog_host"></Option>
+          <Option name="iosacl_syslog_facility"/>
+          <Option name="iosacl_syslog_host"/>
           <Option name="iosacl_use_acl_remarks">False</Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
           <Option name="limit_value">0</Option>
@@ -2177,7 +2177,7 @@
           <Option name="mgmt_addr">10.10.10.0/24</Option>
           <Option name="mgmt_ssh">True</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="pass_all_out">false</Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
@@ -2198,9 +2198,9 @@
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
-          <Option name="scpArgs"></Option>
+          <Option name="scpArgs"/>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="use_scp">False</Option>
           <Option name="verify_interfaces">true</Option>
@@ -2535,8 +2535,8 @@
           <Option name="accept_established">true</Option>
           <Option name="accept_new_tcp_with_no_syn">true</Option>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="check_shading">False</Option>
           <Option name="configure_interfaces">true</Option>
           <Option name="eliminate_duplicates">true</Option>
@@ -2549,10 +2549,10 @@
           <Option name="iosacl_acl_basic">True</Option>
           <Option name="iosacl_acl_no_clear">False</Option>
           <Option name="iosacl_acl_substitution">False</Option>
-          <Option name="iosacl_acl_temp_addr"></Option>
+          <Option name="iosacl_acl_temp_addr"/>
           <Option name="iosacl_add_clear_statements">true</Option>
           <Option name="iosacl_assume_fw_part_of_any">true</Option>
-          <Option name="iosacl_epilog_script"></Option>
+          <Option name="iosacl_epilog_script"/>
           <Option name="iosacl_generate_logging_commands">True</Option>
           <Option name="iosacl_include_comments">True</Option>
           <Option name="iosacl_logging_buffered">True</Option>
@@ -2561,10 +2561,10 @@
           <Option name="iosacl_logging_console_level">6</Option>
           <Option name="iosacl_logging_timestamp">False</Option>
           <Option name="iosacl_logging_trap_level">3</Option>
-          <Option name="iosacl_prolog_script"></Option>
+          <Option name="iosacl_prolog_script"/>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"></Option>
-          <Option name="iosacl_syslog_host"></Option>
+          <Option name="iosacl_syslog_facility"/>
+          <Option name="iosacl_syslog_host"/>
           <Option name="iosacl_use_acl_remarks">True</Option>
           <Option name="iosacl_use_object_groups">False</Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
@@ -2580,7 +2580,7 @@
           <Option name="mgmt_addr">10.3.14.41</Option>
           <Option name="mgmt_ssh">True</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="pass_all_out">false</Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
@@ -2601,9 +2601,9 @@
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
-          <Option name="scpArgs"></Option>
+          <Option name="scpArgs"/>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="use_scp">False</Option>
           <Option name="verify_interfaces">true</Option>
@@ -2961,34 +2961,34 @@
         <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
-          <Option name="action_on_reject"></Option>
-          <Option name="activationCmd"></Option>
+          <Option name="action_on_reject"/>
+          <Option name="activationCmd"/>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">True</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="classify_mark_terminating">False</Option>
           <Option name="cmdline">-xt</Option>
-          <Option name="compiler"></Option>
+          <Option name="compiler"/>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="eliminate_duplicates">true</Option>
           <Option name="enable_ipv6">True</Option>
-          <Option name="epilog_script"></Option>
+          <Option name="epilog_script"/>
           <Option name="fallback_log">False</Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="freebsd_ip_forward">1</Option>
-          <Option name="freebsd_ip_redirect"></Option>
-          <Option name="freebsd_ip_sourceroute"></Option>
+          <Option name="freebsd_ip_redirect"/>
+          <Option name="freebsd_ip_sourceroute"/>
           <Option name="freebsd_ipv6_forward">1</Option>
-          <Option name="freebsd_path_ipf"></Option>
-          <Option name="freebsd_path_ipfw"></Option>
-          <Option name="freebsd_path_ipnat"></Option>
-          <Option name="freebsd_path_sysctl"></Option>
+          <Option name="freebsd_path_ipf"/>
+          <Option name="freebsd_path_ipfw"/>
+          <Option name="freebsd_path_ipnat"/>
+          <Option name="freebsd_path_sysctl"/>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="in_out_code">True</Option>
           <Option name="iosacl_acl_basic">False</Option>
@@ -2997,7 +2997,7 @@
           <Option name="iosacl_acl_temp_addr">fe80::21d:9ff:aaaa:bbbb</Option>
           <Option name="iosacl_add_clear_statements">true</Option>
           <Option name="iosacl_assume_fw_part_of_any">true</Option>
-          <Option name="iosacl_epilog_script"></Option>
+          <Option name="iosacl_epilog_script"/>
           <Option name="iosacl_generate_logging_commands">False</Option>
           <Option name="iosacl_include_comments">True</Option>
           <Option name="iosacl_logging_buffered">False</Option>
@@ -3006,13 +3006,13 @@
           <Option name="iosacl_logging_console_level">0</Option>
           <Option name="iosacl_logging_timestamp">False</Option>
           <Option name="iosacl_logging_trap_level">0</Option>
-          <Option name="iosacl_prolog_script"></Option>
+          <Option name="iosacl_prolog_script"/>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"></Option>
-          <Option name="iosacl_syslog_host"></Option>
-          <Option name="ipt_mangle_only_rulesets"></Option>
+          <Option name="iosacl_syslog_facility"/>
+          <Option name="iosacl_syslog_host"/>
+          <Option name="ipt_mangle_only_rulesets"/>
           <Option name="ipv4_6_order">ipv4_first</Option>
-          <Option name="limit_suffix"></Option>
+          <Option name="limit_suffix"/>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">1</Option>
           <Option name="load_modules">True</Option>
@@ -3027,18 +3027,18 @@
           <Option name="loopback_interface">lo0</Option>
           <Option name="macosx_ip_forward">1</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="mgmt_addr"></Option>
+          <Option name="mgmt_addr"/>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modulate_state">False</Option>
           <Option name="no_ipv6_default_policy">False</Option>
-          <Option name="openbsd_ip_directed_broadcast"></Option>
+          <Option name="openbsd_ip_directed_broadcast"/>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="openbsd_ip_redirect"></Option>
-          <Option name="openbsd_ip_sourceroute"></Option>
+          <Option name="openbsd_ip_redirect"/>
+          <Option name="openbsd_ip_sourceroute"/>
           <Option name="openbsd_ipv6_forward">1</Option>
-          <Option name="openbsd_path_pfctl"></Option>
-          <Option name="openbsd_path_sysctl"></Option>
-          <Option name="output_file"></Option>
+          <Option name="openbsd_path_pfctl"/>
+          <Option name="openbsd_path_sysctl"/>
+          <Option name="output_file"/>
           <Option name="pass_all_out">False</Option>
           <Option name="pf_adaptive_end">0</Option>
           <Option name="pf_adaptive_start">0</Option>
@@ -3057,7 +3057,7 @@
           <Option name="pf_limit_states">10000</Option>
           <Option name="pf_limit_table_entries">0</Option>
           <Option name="pf_limit_tables">0</Option>
-          <Option name="pf_optimization"></Option>
+          <Option name="pf_optimization"/>
           <Option name="pf_other_first">0</Option>
           <Option name="pf_other_multiple">0</Option>
           <Option name="pf_other_single">0</Option>
@@ -3109,12 +3109,12 @@
           <Option name="pix_syslog_device_id_supported">false</Option>
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="prolog_place">fw_file</Option>
-          <Option name="prolog_script"></Option>
+          <Option name="prolog_script"/>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
-          <Option name="scpArgs"></Option>
+          <Option name="scpArgs"/>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -3476,34 +3476,34 @@
         <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
-          <Option name="action_on_reject"></Option>
-          <Option name="activationCmd"></Option>
+          <Option name="action_on_reject"/>
+          <Option name="activationCmd"/>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">True</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="classify_mark_terminating">False</Option>
           <Option name="cmdline">-xt</Option>
-          <Option name="compiler"></Option>
+          <Option name="compiler"/>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="eliminate_duplicates">true</Option>
           <Option name="enable_ipv6">True</Option>
-          <Option name="epilog_script"></Option>
+          <Option name="epilog_script"/>
           <Option name="fallback_log">False</Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="freebsd_ip_forward">1</Option>
-          <Option name="freebsd_ip_redirect"></Option>
-          <Option name="freebsd_ip_sourceroute"></Option>
+          <Option name="freebsd_ip_redirect"/>
+          <Option name="freebsd_ip_sourceroute"/>
           <Option name="freebsd_ipv6_forward">1</Option>
-          <Option name="freebsd_path_ipf"></Option>
-          <Option name="freebsd_path_ipfw"></Option>
-          <Option name="freebsd_path_ipnat"></Option>
-          <Option name="freebsd_path_sysctl"></Option>
+          <Option name="freebsd_path_ipf"/>
+          <Option name="freebsd_path_ipfw"/>
+          <Option name="freebsd_path_ipnat"/>
+          <Option name="freebsd_path_sysctl"/>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="in_out_code">True</Option>
           <Option name="iosacl_acl_basic">False</Option>
@@ -3512,7 +3512,7 @@
           <Option name="iosacl_acl_temp_addr">1.1.1.0/24</Option>
           <Option name="iosacl_add_clear_statements">true</Option>
           <Option name="iosacl_assume_fw_part_of_any">true</Option>
-          <Option name="iosacl_epilog_script"></Option>
+          <Option name="iosacl_epilog_script"/>
           <Option name="iosacl_generate_logging_commands">False</Option>
           <Option name="iosacl_include_comments">True</Option>
           <Option name="iosacl_logging_buffered">False</Option>
@@ -3521,13 +3521,13 @@
           <Option name="iosacl_logging_console_level">2</Option>
           <Option name="iosacl_logging_timestamp">False</Option>
           <Option name="iosacl_logging_trap_level">2</Option>
-          <Option name="iosacl_prolog_script"></Option>
+          <Option name="iosacl_prolog_script"/>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"></Option>
-          <Option name="iosacl_syslog_host"></Option>
-          <Option name="ipt_mangle_only_rulesets"></Option>
+          <Option name="iosacl_syslog_facility"/>
+          <Option name="iosacl_syslog_host"/>
+          <Option name="ipt_mangle_only_rulesets"/>
           <Option name="ipv4_6_order">ipv4_first</Option>
-          <Option name="limit_suffix"></Option>
+          <Option name="limit_suffix"/>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">1</Option>
           <Option name="load_modules">True</Option>
@@ -3546,14 +3546,14 @@
           <Option name="mgmt_ssh">True</Option>
           <Option name="modulate_state">False</Option>
           <Option name="no_ipv6_default_policy">False</Option>
-          <Option name="openbsd_ip_directed_broadcast"></Option>
+          <Option name="openbsd_ip_directed_broadcast"/>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="openbsd_ip_redirect"></Option>
-          <Option name="openbsd_ip_sourceroute"></Option>
+          <Option name="openbsd_ip_redirect"/>
+          <Option name="openbsd_ip_sourceroute"/>
           <Option name="openbsd_ipv6_forward">1</Option>
-          <Option name="openbsd_path_pfctl"></Option>
-          <Option name="openbsd_path_sysctl"></Option>
-          <Option name="output_file"></Option>
+          <Option name="openbsd_path_pfctl"/>
+          <Option name="openbsd_path_sysctl"/>
+          <Option name="output_file"/>
           <Option name="pass_all_out">False</Option>
           <Option name="pf_adaptive_end">0</Option>
           <Option name="pf_adaptive_start">0</Option>
@@ -3572,7 +3572,7 @@
           <Option name="pf_limit_states">10000</Option>
           <Option name="pf_limit_table_entries">0</Option>
           <Option name="pf_limit_tables">0</Option>
-          <Option name="pf_optimization"></Option>
+          <Option name="pf_optimization"/>
           <Option name="pf_other_first">0</Option>
           <Option name="pf_other_multiple">0</Option>
           <Option name="pf_other_single">0</Option>
@@ -3624,12 +3624,12 @@
           <Option name="pix_syslog_device_id_supported">false</Option>
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="prolog_place">fw_file</Option>
-          <Option name="prolog_script"></Option>
+          <Option name="prolog_script"/>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
-          <Option name="scpArgs"></Option>
+          <Option name="scpArgs"/>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -4018,34 +4018,34 @@
         <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
-          <Option name="action_on_reject"></Option>
-          <Option name="activationCmd"></Option>
+          <Option name="action_on_reject"/>
+          <Option name="activationCmd"/>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">True</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="classify_mark_terminating">False</Option>
           <Option name="cmdline">-xt</Option>
-          <Option name="compiler"></Option>
+          <Option name="compiler"/>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="eliminate_duplicates">true</Option>
           <Option name="enable_ipv6">True</Option>
-          <Option name="epilog_script"></Option>
+          <Option name="epilog_script"/>
           <Option name="fallback_log">False</Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="freebsd_ip_forward">1</Option>
-          <Option name="freebsd_ip_redirect"></Option>
-          <Option name="freebsd_ip_sourceroute"></Option>
+          <Option name="freebsd_ip_redirect"/>
+          <Option name="freebsd_ip_sourceroute"/>
           <Option name="freebsd_ipv6_forward">1</Option>
-          <Option name="freebsd_path_ipf"></Option>
-          <Option name="freebsd_path_ipfw"></Option>
-          <Option name="freebsd_path_ipnat"></Option>
-          <Option name="freebsd_path_sysctl"></Option>
+          <Option name="freebsd_path_ipf"/>
+          <Option name="freebsd_path_ipfw"/>
+          <Option name="freebsd_path_ipnat"/>
+          <Option name="freebsd_path_sysctl"/>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="in_out_code">True</Option>
           <Option name="iosacl_acl_basic">False</Option>
@@ -4054,7 +4054,7 @@
           <Option name="iosacl_acl_temp_addr">10.1.1.0</Option>
           <Option name="iosacl_add_clear_statements">true</Option>
           <Option name="iosacl_assume_fw_part_of_any">true</Option>
-          <Option name="iosacl_epilog_script"></Option>
+          <Option name="iosacl_epilog_script"/>
           <Option name="iosacl_generate_logging_commands">False</Option>
           <Option name="iosacl_include_comments">True</Option>
           <Option name="iosacl_logging_buffered">False</Option>
@@ -4063,13 +4063,13 @@
           <Option name="iosacl_logging_console_level">2</Option>
           <Option name="iosacl_logging_timestamp">False</Option>
           <Option name="iosacl_logging_trap_level">2</Option>
-          <Option name="iosacl_prolog_script"></Option>
+          <Option name="iosacl_prolog_script"/>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"></Option>
-          <Option name="iosacl_syslog_host"></Option>
-          <Option name="ipt_mangle_only_rulesets"></Option>
+          <Option name="iosacl_syslog_facility"/>
+          <Option name="iosacl_syslog_host"/>
+          <Option name="ipt_mangle_only_rulesets"/>
           <Option name="ipv4_6_order">ipv4_first</Option>
-          <Option name="limit_suffix"></Option>
+          <Option name="limit_suffix"/>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">1</Option>
           <Option name="load_modules">True</Option>
@@ -4088,14 +4088,14 @@
           <Option name="mgmt_ssh">True</Option>
           <Option name="modulate_state">False</Option>
           <Option name="no_ipv6_default_policy">False</Option>
-          <Option name="openbsd_ip_directed_broadcast"></Option>
+          <Option name="openbsd_ip_directed_broadcast"/>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="openbsd_ip_redirect"></Option>
-          <Option name="openbsd_ip_sourceroute"></Option>
+          <Option name="openbsd_ip_redirect"/>
+          <Option name="openbsd_ip_sourceroute"/>
           <Option name="openbsd_ipv6_forward">1</Option>
-          <Option name="openbsd_path_pfctl"></Option>
-          <Option name="openbsd_path_sysctl"></Option>
-          <Option name="output_file"></Option>
+          <Option name="openbsd_path_pfctl"/>
+          <Option name="openbsd_path_sysctl"/>
+          <Option name="output_file"/>
           <Option name="pass_all_out">False</Option>
           <Option name="pf_adaptive_end">0</Option>
           <Option name="pf_adaptive_start">0</Option>
@@ -4114,7 +4114,7 @@
           <Option name="pf_limit_states">10000</Option>
           <Option name="pf_limit_table_entries">0</Option>
           <Option name="pf_limit_tables">0</Option>
-          <Option name="pf_optimization"></Option>
+          <Option name="pf_optimization"/>
           <Option name="pf_other_first">0</Option>
           <Option name="pf_other_multiple">0</Option>
           <Option name="pf_other_single">0</Option>
@@ -4166,12 +4166,12 @@
           <Option name="pix_syslog_device_id_supported">false</Option>
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="prolog_place">fw_file</Option>
-          <Option name="prolog_script"></Option>
+          <Option name="prolog_script"/>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
-          <Option name="scpArgs"></Option>
+          <Option name="scpArgs"/>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -4312,34 +4312,34 @@
         <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
-          <Option name="action_on_reject"></Option>
-          <Option name="activationCmd"></Option>
+          <Option name="action_on_reject"/>
+          <Option name="activationCmd"/>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">True</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="classify_mark_terminating">False</Option>
           <Option name="cmdline">-xt</Option>
-          <Option name="compiler"></Option>
+          <Option name="compiler"/>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="eliminate_duplicates">true</Option>
           <Option name="enable_ipv6">True</Option>
-          <Option name="epilog_script"></Option>
+          <Option name="epilog_script"/>
           <Option name="fallback_log">False</Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="freebsd_ip_forward">1</Option>
-          <Option name="freebsd_ip_redirect"></Option>
-          <Option name="freebsd_ip_sourceroute"></Option>
+          <Option name="freebsd_ip_redirect"/>
+          <Option name="freebsd_ip_sourceroute"/>
           <Option name="freebsd_ipv6_forward">1</Option>
-          <Option name="freebsd_path_ipf"></Option>
-          <Option name="freebsd_path_ipfw"></Option>
-          <Option name="freebsd_path_ipnat"></Option>
-          <Option name="freebsd_path_sysctl"></Option>
+          <Option name="freebsd_path_ipf"/>
+          <Option name="freebsd_path_ipfw"/>
+          <Option name="freebsd_path_ipnat"/>
+          <Option name="freebsd_path_sysctl"/>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="in_out_code">True</Option>
           <Option name="iosacl_acl_basic">False</Option>
@@ -4348,7 +4348,7 @@
           <Option name="iosacl_acl_temp_addr">fe80::21d:9ff:aaaa:bbbb/64</Option>
           <Option name="iosacl_add_clear_statements">true</Option>
           <Option name="iosacl_assume_fw_part_of_any">true</Option>
-          <Option name="iosacl_epilog_script"></Option>
+          <Option name="iosacl_epilog_script"/>
           <Option name="iosacl_generate_logging_commands">False</Option>
           <Option name="iosacl_include_comments">True</Option>
           <Option name="iosacl_logging_buffered">False</Option>
@@ -4357,13 +4357,13 @@
           <Option name="iosacl_logging_console_level">1</Option>
           <Option name="iosacl_logging_timestamp">False</Option>
           <Option name="iosacl_logging_trap_level">1</Option>
-          <Option name="iosacl_prolog_script"></Option>
+          <Option name="iosacl_prolog_script"/>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"></Option>
-          <Option name="iosacl_syslog_host"></Option>
-          <Option name="ipt_mangle_only_rulesets"></Option>
+          <Option name="iosacl_syslog_facility"/>
+          <Option name="iosacl_syslog_host"/>
+          <Option name="ipt_mangle_only_rulesets"/>
           <Option name="ipv4_6_order">ipv4_first</Option>
-          <Option name="limit_suffix"></Option>
+          <Option name="limit_suffix"/>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">1</Option>
           <Option name="load_modules">True</Option>
@@ -4378,18 +4378,18 @@
           <Option name="loopback_interface">lo0</Option>
           <Option name="macosx_ip_forward">1</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="mgmt_addr"></Option>
+          <Option name="mgmt_addr"/>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modulate_state">False</Option>
           <Option name="no_ipv6_default_policy">False</Option>
-          <Option name="openbsd_ip_directed_broadcast"></Option>
+          <Option name="openbsd_ip_directed_broadcast"/>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="openbsd_ip_redirect"></Option>
-          <Option name="openbsd_ip_sourceroute"></Option>
+          <Option name="openbsd_ip_redirect"/>
+          <Option name="openbsd_ip_sourceroute"/>
           <Option name="openbsd_ipv6_forward">1</Option>
-          <Option name="openbsd_path_pfctl"></Option>
-          <Option name="openbsd_path_sysctl"></Option>
-          <Option name="output_file"></Option>
+          <Option name="openbsd_path_pfctl"/>
+          <Option name="openbsd_path_sysctl"/>
+          <Option name="output_file"/>
           <Option name="pass_all_out">False</Option>
           <Option name="pf_adaptive_end">0</Option>
           <Option name="pf_adaptive_start">0</Option>
@@ -4408,7 +4408,7 @@
           <Option name="pf_limit_states">10000</Option>
           <Option name="pf_limit_table_entries">0</Option>
           <Option name="pf_limit_tables">0</Option>
-          <Option name="pf_optimization"></Option>
+          <Option name="pf_optimization"/>
           <Option name="pf_other_first">0</Option>
           <Option name="pf_other_multiple">0</Option>
           <Option name="pf_other_single">0</Option>
@@ -4460,12 +4460,12 @@
           <Option name="pix_syslog_device_id_supported">false</Option>
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="prolog_place">fw_file</Option>
-          <Option name="prolog_script"></Option>
+          <Option name="prolog_script"/>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
-          <Option name="scpArgs"></Option>
+          <Option name="scpArgs"/>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -4792,10 +4792,10 @@
           <Option name="accept_established">true</Option>
           <Option name="accept_new_tcp_with_no_syn">true</Option>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="check_shading">False</Option>
-          <Option name="compiler"></Option>
+          <Option name="compiler"/>
           <Option name="configure_interfaces">true</Option>
           <Option name="eliminate_duplicates">true</Option>
           <Option name="firewall_dir">/etc</Option>
@@ -4808,21 +4808,21 @@
           <Option name="iosacl_acl_basic">True</Option>
           <Option name="iosacl_acl_no_clear">False</Option>
           <Option name="iosacl_acl_substitution">False</Option>
-          <Option name="iosacl_acl_temp_addr"></Option>
+          <Option name="iosacl_acl_temp_addr"/>
           <Option name="iosacl_add_clear_statements">true</Option>
           <Option name="iosacl_assume_fw_part_of_any">true</Option>
-          <Option name="iosacl_epilog_script"></Option>
+          <Option name="iosacl_epilog_script"/>
           <Option name="iosacl_include_comments">True</Option>
           <Option name="iosacl_logging_buffered">False</Option>
-          <Option name="iosacl_logging_buffered_level"></Option>
+          <Option name="iosacl_logging_buffered_level"/>
           <Option name="iosacl_logging_console">False</Option>
-          <Option name="iosacl_logging_console_level"></Option>
+          <Option name="iosacl_logging_console_level"/>
           <Option name="iosacl_logging_timestamp">False</Option>
-          <Option name="iosacl_logging_trap_level"></Option>
-          <Option name="iosacl_prolog_script"></Option>
+          <Option name="iosacl_logging_trap_level"/>
+          <Option name="iosacl_prolog_script"/>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"></Option>
-          <Option name="iosacl_syslog_host"></Option>
+          <Option name="iosacl_syslog_facility"/>
+          <Option name="iosacl_syslog_host"/>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">1</Option>
           <Option name="load_modules">true</Option>
@@ -4832,10 +4832,10 @@
           <Option name="loopback_interface">lo0</Option>
           <Option name="macosx_ip_forward">1</Option>
           <Option name="manage_virtual_addr">true</Option>
-          <Option name="mgmt_addr"></Option>
+          <Option name="mgmt_addr"/>
           <Option name="mgmt_ssh">False</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="pass_all_out">false</Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
@@ -4857,7 +4857,7 @@
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="verify_interfaces">true</Option>
         </FirewallOptions>
@@ -4990,8 +4990,8 @@
           <Option name="accept_established">true</Option>
           <Option name="accept_new_tcp_with_no_syn">true</Option>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="check_shading">False</Option>
           <Option name="configure_interfaces">true</Option>
           <Option name="eliminate_duplicates">true</Option>
@@ -5009,7 +5009,7 @@
           <Option name="iosacl_acl_temp_addr">10.10.10.0/24</Option>
           <Option name="iosacl_add_clear_statements">true</Option>
           <Option name="iosacl_assume_fw_part_of_any">true</Option>
-          <Option name="iosacl_epilog_script"></Option>
+          <Option name="iosacl_epilog_script"/>
           <Option name="iosacl_generate_logging_commands">False</Option>
           <Option name="iosacl_include_comments">True</Option>
           <Option name="iosacl_logging_buffered">False</Option>
@@ -5018,10 +5018,10 @@
           <Option name="iosacl_logging_console_level">3</Option>
           <Option name="iosacl_logging_timestamp">False</Option>
           <Option name="iosacl_logging_trap_level">3</Option>
-          <Option name="iosacl_prolog_script"></Option>
+          <Option name="iosacl_prolog_script"/>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"></Option>
-          <Option name="iosacl_syslog_host"></Option>
+          <Option name="iosacl_syslog_facility"/>
+          <Option name="iosacl_syslog_host"/>
           <Option name="iosacl_use_acl_remarks">False</Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
           <Option name="limit_value">0</Option>
@@ -5036,7 +5036,7 @@
           <Option name="mgmt_addr">10.10.10.0/24</Option>
           <Option name="mgmt_ssh">True</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="pass_all_out">false</Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
@@ -5057,9 +5057,9 @@
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
-          <Option name="scpArgs"></Option>
+          <Option name="scpArgs"/>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="use_scp">False</Option>
           <Option name="verify_interfaces">true</Option>
@@ -5194,8 +5194,8 @@
           <Option name="accept_established">true</Option>
           <Option name="accept_new_tcp_with_no_syn">true</Option>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="check_shading">False</Option>
           <Option name="configure_interfaces">true</Option>
           <Option name="eliminate_duplicates">true</Option>
@@ -5213,7 +5213,7 @@
           <Option name="iosacl_acl_temp_addr">10.10.10.0/24</Option>
           <Option name="iosacl_add_clear_statements">true</Option>
           <Option name="iosacl_assume_fw_part_of_any">true</Option>
-          <Option name="iosacl_epilog_script"></Option>
+          <Option name="iosacl_epilog_script"/>
           <Option name="iosacl_generate_logging_commands">False</Option>
           <Option name="iosacl_include_comments">True</Option>
           <Option name="iosacl_logging_buffered">False</Option>
@@ -5222,10 +5222,10 @@
           <Option name="iosacl_logging_console_level">4</Option>
           <Option name="iosacl_logging_timestamp">False</Option>
           <Option name="iosacl_logging_trap_level">4</Option>
-          <Option name="iosacl_prolog_script"></Option>
+          <Option name="iosacl_prolog_script"/>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"></Option>
-          <Option name="iosacl_syslog_host"></Option>
+          <Option name="iosacl_syslog_facility"/>
+          <Option name="iosacl_syslog_host"/>
           <Option name="iosacl_use_acl_remarks">False</Option>
           <Option name="iosacl_use_object_groups">True</Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
@@ -5241,7 +5241,7 @@
           <Option name="mgmt_addr">10.10.10.0/24</Option>
           <Option name="mgmt_ssh">True</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="pass_all_out">false</Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
@@ -5262,9 +5262,9 @@
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
-          <Option name="scpArgs"></Option>
+          <Option name="scpArgs"/>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="use_scp">False</Option>
           <Option name="verify_interfaces">true</Option>
@@ -5573,18 +5573,18 @@
         </Management>
         <FirewallOptions>
           <Option name="admUser">vadim</Option>
-          <Option name="altAddress"></Option>
+          <Option name="altAddress"/>
           <Option name="check_shading">False</Option>
-          <Option name="filesystem"></Option>
-          <Option name="firewall_dir"></Option>
+          <Option name="filesystem"/>
+          <Option name="firewall_dir"/>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="iosacl_acl_basic">True</Option>
           <Option name="iosacl_acl_no_clear">False</Option>
           <Option name="iosacl_acl_substitution">False</Option>
-          <Option name="iosacl_acl_temp_addr"></Option>
+          <Option name="iosacl_acl_temp_addr"/>
           <Option name="iosacl_add_clear_statements">true</Option>
           <Option name="iosacl_assume_fw_part_of_any">true</Option>
-          <Option name="iosacl_epilog_script"></Option>
+          <Option name="iosacl_epilog_script"/>
           <Option name="iosacl_generate_logging_commands">False</Option>
           <Option name="iosacl_include_comments">True</Option>
           <Option name="iosacl_logging_buffered">False</Option>
@@ -5593,18 +5593,18 @@
           <Option name="iosacl_logging_console_level">4</Option>
           <Option name="iosacl_logging_timestamp">False</Option>
           <Option name="iosacl_logging_trap_level">4</Option>
-          <Option name="iosacl_prolog_script"></Option>
+          <Option name="iosacl_prolog_script"/>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"></Option>
-          <Option name="iosacl_syslog_host"></Option>
+          <Option name="iosacl_syslog_facility"/>
+          <Option name="iosacl_syslog_host"/>
           <Option name="iosacl_use_acl_remarks">False</Option>
           <Option name="iosacl_use_object_groups">True</Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
           <Option name="mgmt_addr">10.3.14.0/24</Option>
           <Option name="mgmt_ssh">True</Option>
-          <Option name="output_file"></Option>
-          <Option name="scpArgs"></Option>
-          <Option name="sshArgs"></Option>
+          <Option name="output_file"/>
+          <Option name="scpArgs"/>
+          <Option name="sshArgs"/>
           <Option name="use_scp">True</Option>
         </FirewallOptions>
       </Firewall>
@@ -5962,8 +5962,8 @@
           <Option name="accept_established">true</Option>
           <Option name="accept_new_tcp_with_no_syn">true</Option>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="check_shading">False</Option>
           <Option name="configure_interfaces">true</Option>
           <Option name="eliminate_duplicates">true</Option>
@@ -5981,7 +5981,7 @@
           <Option name="iosacl_acl_temp_addr">10.10.10.0/24</Option>
           <Option name="iosacl_add_clear_statements">true</Option>
           <Option name="iosacl_assume_fw_part_of_any">true</Option>
-          <Option name="iosacl_epilog_script"></Option>
+          <Option name="iosacl_epilog_script"/>
           <Option name="iosacl_generate_logging_commands">False</Option>
           <Option name="iosacl_include_comments">True</Option>
           <Option name="iosacl_logging_buffered">False</Option>
@@ -5990,10 +5990,10 @@
           <Option name="iosacl_logging_console_level">7</Option>
           <Option name="iosacl_logging_timestamp">False</Option>
           <Option name="iosacl_logging_trap_level">7</Option>
-          <Option name="iosacl_prolog_script"></Option>
+          <Option name="iosacl_prolog_script"/>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"></Option>
-          <Option name="iosacl_syslog_host"></Option>
+          <Option name="iosacl_syslog_facility"/>
+          <Option name="iosacl_syslog_host"/>
           <Option name="iosacl_use_acl_remarks">False</Option>
           <Option name="iosacl_use_object_groups">False</Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
@@ -6009,7 +6009,7 @@
           <Option name="mgmt_addr">10.10.10.0/24</Option>
           <Option name="mgmt_ssh">True</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="pass_all_out">false</Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
@@ -6030,9 +6030,9 @@
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
-          <Option name="scpArgs"></Option>
+          <Option name="scpArgs"/>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="use_scp">False</Option>
           <Option name="verify_interfaces">true</Option>
@@ -6371,8 +6371,8 @@
           <Option name="accept_established">true</Option>
           <Option name="accept_new_tcp_with_no_syn">true</Option>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="check_shading">False</Option>
           <Option name="configure_interfaces">true</Option>
           <Option name="eliminate_duplicates">true</Option>
@@ -6390,7 +6390,7 @@
           <Option name="iosacl_acl_temp_addr">10.10.10.0/24</Option>
           <Option name="iosacl_add_clear_statements">true</Option>
           <Option name="iosacl_assume_fw_part_of_any">true</Option>
-          <Option name="iosacl_epilog_script"></Option>
+          <Option name="iosacl_epilog_script"/>
           <Option name="iosacl_generate_logging_commands">False</Option>
           <Option name="iosacl_include_comments">True</Option>
           <Option name="iosacl_logging_buffered">False</Option>
@@ -6399,10 +6399,10 @@
           <Option name="iosacl_logging_console_level">6</Option>
           <Option name="iosacl_logging_timestamp">False</Option>
           <Option name="iosacl_logging_trap_level">6</Option>
-          <Option name="iosacl_prolog_script"></Option>
+          <Option name="iosacl_prolog_script"/>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"></Option>
-          <Option name="iosacl_syslog_host"></Option>
+          <Option name="iosacl_syslog_facility"/>
+          <Option name="iosacl_syslog_host"/>
           <Option name="iosacl_use_acl_remarks">False</Option>
           <Option name="iosacl_use_object_groups">True</Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
@@ -6418,7 +6418,7 @@
           <Option name="mgmt_addr">10.10.10.0/24</Option>
           <Option name="mgmt_ssh">True</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="pass_all_out">false</Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
@@ -6439,9 +6439,9 @@
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
-          <Option name="scpArgs"></Option>
+          <Option name="scpArgs"/>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="use_scp">False</Option>
           <Option name="verify_interfaces">true</Option>
@@ -6970,10 +6970,10 @@
           <Option name="accept_established">true</Option>
           <Option name="accept_new_tcp_with_no_syn">true</Option>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="check_shading">False</Option>
-          <Option name="compiler"></Option>
+          <Option name="compiler"/>
           <Option name="configure_interfaces">true</Option>
           <Option name="eliminate_duplicates">true</Option>
           <Option name="filesystem">/etc</Option>
@@ -7002,8 +7002,8 @@
           <Option name="iosacl_logging_trap_level">4</Option>
           <Option name="iosacl_prolog_script">! This is prolog</Option>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"></Option>
-          <Option name="iosacl_syslog_host"></Option>
+          <Option name="iosacl_syslog_facility"/>
+          <Option name="iosacl_syslog_host"/>
           <Option name="iosacl_use_acl_remarks">False</Option>
           <Option name="iosacl_use_object_groups">False</Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
@@ -7019,7 +7019,7 @@
           <Option name="mgmt_addr">1.1.1.100</Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="pass_all_out">false</Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
@@ -7040,9 +7040,9 @@
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
-          <Option name="scpArgs"></Option>
+          <Option name="scpArgs"/>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="use_scp">False</Option>
           <Option name="verify_interfaces">true</Option>
@@ -7285,8 +7285,8 @@
           <Option name="accept_established">true</Option>
           <Option name="accept_new_tcp_with_no_syn">true</Option>
           <Option name="add_check_state_rule">true</Option>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="check_shading">False</Option>
           <Option name="configure_interfaces">true</Option>
           <Option name="eliminate_duplicates">true</Option>
@@ -7302,7 +7302,7 @@
           <Option name="iosacl_acl_temp_addr">192.168.1.1</Option>
           <Option name="iosacl_add_clear_statements">true</Option>
           <Option name="iosacl_assume_fw_part_of_any">true</Option>
-          <Option name="iosacl_epilog_script"></Option>
+          <Option name="iosacl_epilog_script"/>
           <Option name="iosacl_generate_logging_commands">False</Option>
           <Option name="iosacl_include_comments">True</Option>
           <Option name="iosacl_logging_buffered">False</Option>
@@ -7311,10 +7311,10 @@
           <Option name="iosacl_logging_console_level">0</Option>
           <Option name="iosacl_logging_timestamp">False</Option>
           <Option name="iosacl_logging_trap_level">0</Option>
-          <Option name="iosacl_prolog_script"></Option>
+          <Option name="iosacl_prolog_script"/>
           <Option name="iosacl_regroup_commands">False</Option>
-          <Option name="iosacl_syslog_facility"></Option>
-          <Option name="iosacl_syslog_host"></Option>
+          <Option name="iosacl_syslog_facility"/>
+          <Option name="iosacl_syslog_host"/>
           <Option name="iosacl_use_acl_remarks">False</Option>
           <Option name="iosacl_use_object_groups">False</Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
@@ -7327,10 +7327,10 @@
           <Option name="loopback_interface">lo0</Option>
           <Option name="macosx_ip_forward">1</Option>
           <Option name="manage_virtual_addr">true</Option>
-          <Option name="mgmt_addr"></Option>
+          <Option name="mgmt_addr"/>
           <Option name="mgmt_ssh">False</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="pass_all_out">false</Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
@@ -7351,9 +7351,9 @@
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
-          <Option name="scpArgs"></Option>
+          <Option name="scpArgs"/>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="use_scp">False</Option>
           <Option name="verify_interfaces">true</Option>
diff --git a/test/pix/cluster-tests.fwb b/test/pix/cluster-tests.fwb
index 3b3f48f64..d430224f2 100644
--- a/test/pix/cluster-tests.fwb
+++ b/test/pix/cluster-tests.fwb
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
-<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="17" lastModified="1269894581" id="root">
+<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="18" lastModified="1269894581" id="root">
   <Library id="syslib000" color="#d4f8ff" name="Standard" comment="Standard objects" ro="True">
     <AnyNetwork id="sysid0" name="Any" comment="Any Network" ro="False" address="0.0.0.0" netmask="0.0.0.0"/>
     <AnyIPService id="sysid1" protocol_num="0" name="Any" comment="Any IP Service" ro="False"/>
@@ -51,9 +51,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"></Option>
-            <Option name="snmp_description"></Option>
-            <Option name="snmp_location"></Option>
+            <Option name="snmp_contact"/>
+            <Option name="snmp_description"/>
+            <Option name="snmp_location"/>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -69,9 +69,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"></Option>
-            <Option name="snmp_description"></Option>
-            <Option name="snmp_location"></Option>
+            <Option name="snmp_contact"/>
+            <Option name="snmp_description"/>
+            <Option name="snmp_location"/>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -100,16 +100,16 @@
     </ObjectGroup>
     <ServiceGroup id="stdid05" name="Services" comment="" ro="False">
       <CustomService id="stdid14_1" name="ESTABLISHED" comment="This service matches all packets which are part of network connections established through the firewall, or connections 'related' to those established through the firewall. Term 'established' refers to the state tracking mechanism which exists inside iptables and other stateful firewalls and does not mean any particular combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful inspection module made appropriate record in the state table. Usually stateful firewalls keep track of network connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' describes packet belonging to a separate network connection, related to the session firewall is keeping track of. One example is FTP command and FTP data sessions." ro="False" protocol="any" address_family="ipv4">
-        <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+        <CustomServiceCommand platform="Undefined"/>
         <CustomServiceCommand platform="iosacl">established</CustomServiceCommand>
-        <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+        <CustomServiceCommand platform="ipfilter"/>
         <CustomServiceCommand platform="ipfw">established</CustomServiceCommand>
         <CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
       </CustomService>
       <CustomService id="stdid14_2" name="ESTABLISHED ipv6" comment="This service matches all packets which are part of network connections established through the firewall, or connections 'related' to those established through the firewall. Term 'established' refers to the state tracking mechanism which exists inside iptables and other stateful firewalls and does not mean any particular combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful inspection module made appropriate record in the state table. Usually stateful firewalls keep track of network connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' describes packet belonging to a separate network connection, related to the session firewall is keeping track of. One example is FTP command and FTP data sessions." ro="False" protocol="any" address_family="ipv6">
-        <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+        <CustomServiceCommand platform="Undefined"/>
         <CustomServiceCommand platform="iosacl">established</CustomServiceCommand>
-        <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+        <CustomServiceCommand platform="ipfilter"/>
         <CustomServiceCommand platform="ipfw">established</CustomServiceCommand>
         <CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
       </CustomService>
@@ -350,54 +350,54 @@
       </ServiceGroup>
       <ServiceGroup id="stdid13" name="Custom" comment="" ro="False">
         <CustomService id="id3B64EEA8" name="rpc" comment="works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
+          <CustomServiceCommand platform="Undefined"/>
+          <CustomServiceCommand platform="ipf"/>
+          <CustomServiceCommand platform="ipfilter"/>
+          <CustomServiceCommand platform="ipfw"/>
           <CustomServiceCommand platform="iptables">-m record_rpc</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"></CustomServiceCommand>
-          <CustomServiceCommand platform="pix"></CustomServiceCommand>
-          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
+          <CustomServiceCommand platform="pf"/>
+          <CustomServiceCommand platform="pix"/>
+          <CustomServiceCommand platform="unknown"/>
         </CustomService>
         <CustomService id="id3B64EF4E" name="irc-conn" comment="IRC connection tracker, supports DCC.&#10;Works on iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/&#10;" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
+          <CustomServiceCommand platform="Undefined"/>
+          <CustomServiceCommand platform="ipf"/>
+          <CustomServiceCommand platform="ipfilter"/>
+          <CustomServiceCommand platform="ipfw"/>
           <CustomServiceCommand platform="iptables">-m irc</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"></CustomServiceCommand>
-          <CustomServiceCommand platform="pix"></CustomServiceCommand>
-          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
+          <CustomServiceCommand platform="pf"/>
+          <CustomServiceCommand platform="pix"/>
+          <CustomServiceCommand platform="unknown"/>
         </CustomService>
         <CustomService id="id3B64EF50" name="psd" comment="Port scan detector, works only on iptables and  requires patch-o-matic &#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
+          <CustomServiceCommand platform="Undefined"/>
+          <CustomServiceCommand platform="ipf"/>
+          <CustomServiceCommand platform="ipfilter"/>
+          <CustomServiceCommand platform="ipfw"/>
           <CustomServiceCommand platform="iptables">-m psd --psd-weight-threshold 5 --psd-delay-threshold 10000</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"></CustomServiceCommand>
-          <CustomServiceCommand platform="pix"></CustomServiceCommand>
-          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
+          <CustomServiceCommand platform="pf"/>
+          <CustomServiceCommand platform="pix"/>
+          <CustomServiceCommand platform="unknown"/>
         </CustomService>
         <CustomService id="id3B64EF52" name="string" comment="Matches a string in a whole packet, works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
+          <CustomServiceCommand platform="Undefined"/>
+          <CustomServiceCommand platform="ipf"/>
+          <CustomServiceCommand platform="ipfilter"/>
+          <CustomServiceCommand platform="ipfw"/>
           <CustomServiceCommand platform="iptables">-m string --string test_pattern</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"></CustomServiceCommand>
-          <CustomServiceCommand platform="pix"></CustomServiceCommand>
-          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
+          <CustomServiceCommand platform="pf"/>
+          <CustomServiceCommand platform="pix"/>
+          <CustomServiceCommand platform="unknown"/>
         </CustomService>
         <CustomService id="id3B64EF54" name="talk" comment="Talk protocol support. Works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
+          <CustomServiceCommand platform="Undefined"/>
+          <CustomServiceCommand platform="ipf"/>
+          <CustomServiceCommand platform="ipfilter"/>
+          <CustomServiceCommand platform="ipfw"/>
           <CustomServiceCommand platform="iptables">-m talk</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"></CustomServiceCommand>
-          <CustomServiceCommand platform="pix"></CustomServiceCommand>
-          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
+          <CustomServiceCommand platform="pf"/>
+          <CustomServiceCommand platform="pix"/>
+          <CustomServiceCommand platform="unknown"/>
         </CustomService>
       </ServiceGroup>
       <ServiceGroup id="stdid19" name="TagServices" comment="" ro="False"/>
@@ -451,15 +451,15 @@
           <Option name="hashlimit_mode_dstport">False</Option>
           <Option name="hashlimit_mode_srcip">False</Option>
           <Option name="hashlimit_mode_srcport">False</Option>
-          <Option name="hashlimit_name"></Option>
+          <Option name="hashlimit_name"/>
           <Option name="hashlimit_size">0</Option>
           <Option name="hashlimit_suffix">/second</Option>
           <Option name="hashlimit_value">10</Option>
           <Option name="limit_burst">0</Option>
-          <Option name="limit_suffix"></Option>
+          <Option name="limit_suffix"/>
           <Option name="limit_value">0</Option>
-          <Option name="log_level"></Option>
-          <Option name="log_prefix"></Option>
+          <Option name="log_level"/>
+          <Option name="log_prefix"/>
           <Option name="stateless">True</Option>
           <Option name="ulog_nlgroup">1</Option>
         </PolicyRuleOptions>
@@ -496,15 +496,15 @@
           <Option name="hashlimit_mode_dstport">False</Option>
           <Option name="hashlimit_mode_srcip">False</Option>
           <Option name="hashlimit_mode_srcport">False</Option>
-          <Option name="hashlimit_name"></Option>
+          <Option name="hashlimit_name"/>
           <Option name="hashlimit_size">0</Option>
           <Option name="hashlimit_suffix">/second</Option>
           <Option name="hashlimit_value">10</Option>
           <Option name="limit_burst">0</Option>
-          <Option name="limit_suffix"></Option>
+          <Option name="limit_suffix"/>
           <Option name="limit_value">0</Option>
-          <Option name="log_level"></Option>
-          <Option name="log_prefix"></Option>
+          <Option name="log_level"/>
+          <Option name="log_prefix"/>
           <Option name="stateless">True</Option>
           <Option name="ulog_nlgroup">1</Option>
         </PolicyRuleOptions>
@@ -575,16 +575,16 @@
       <FirewallOptions>
         <Option name="accept_established">True</Option>
         <Option name="accept_new_tcp_with_no_syn">True</Option>
-        <Option name="action_on_reject"></Option>
-        <Option name="activationCmd"></Option>
-        <Option name="admUser"></Option>
-        <Option name="altAddress"></Option>
+        <Option name="action_on_reject"/>
+        <Option name="activationCmd"/>
+        <Option name="admUser"/>
+        <Option name="altAddress"/>
         <Option name="bridging_fw">False</Option>
         <Option name="check_shading">False</Option>
         <Option name="clamp_mss_to_mtu">False</Option>
         <Option name="classify_mark_terminating">False</Option>
-        <Option name="cmdline"></Option>
-        <Option name="compiler"></Option>
+        <Option name="cmdline"/>
+        <Option name="compiler"/>
         <Option name="configure_interfaces">True</Option>
         <Option name="configure_vlan_interfaces">True</Option>
         <Option name="ctiqbe_fixup">2 2748 0 nil 0</Option>
@@ -592,7 +592,7 @@
         <Option name="dns_fixup">2 65535 0 nil 0</Option>
         <Option name="drop_invalid">False</Option>
         <Option name="eliminate_duplicates">true</Option>
-        <Option name="epilog_script"></Option>
+        <Option name="epilog_script"/>
         <Option name="espike_fixup">2 0 0 nil 0</Option>
         <Option name="firewall_dir">/etc</Option>
         <Option name="firewall_is_part_of_any_and_networks">True</Option>
@@ -605,9 +605,9 @@
         <Option name="icmp_error_fixup">2 0 0 nil 0</Option>
         <Option name="ignore_empty_groups">False</Option>
         <Option name="ils_fixup">2 389 389 nil 0</Option>
-        <Option name="ipt_mangle_only_rulesets"></Option>
+        <Option name="ipt_mangle_only_rulesets"/>
         <Option name="ipv4_6_order">ipv4_first</Option>
-        <Option name="limit_suffix"></Option>
+        <Option name="limit_suffix"/>
         <Option name="limit_value">0</Option>
         <Option name="linux24_ip_forward">1</Option>
         <Option name="load_modules">True</Option>
@@ -623,11 +623,11 @@
         <Option name="macosx_ip_forward">1</Option>
         <Option name="manage_virtual_addr">True</Option>
         <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-        <Option name="mgmt_addr"></Option>
+        <Option name="mgmt_addr"/>
         <Option name="mgmt_ssh">False</Option>
         <Option name="modules_dir">/lib/modules/`uname -r`/kernel/net/</Option>
         <Option name="openbsd_ip_forward">1</Option>
-        <Option name="output_file"></Option>
+        <Option name="output_file"/>
         <Option name="pf_limit_frags">5000</Option>
         <Option name="pf_limit_states">10000</Option>
         <Option name="pf_timeout_frag">30</Option>
@@ -643,31 +643,31 @@
         <Option name="pix_floodguard">true</Option>
         <Option name="pix_include_comments">true</Option>
         <Option name="pix_ip_address">True</Option>
-        <Option name="pix_ntp1"></Option>
+        <Option name="pix_ntp1"/>
         <Option name="pix_ntp1_pref">False</Option>
-        <Option name="pix_ntp2"></Option>
+        <Option name="pix_ntp2"/>
         <Option name="pix_ntp2_pref">False</Option>
-        <Option name="pix_ntp3"></Option>
+        <Option name="pix_ntp3"/>
         <Option name="pix_ntp3_pref">False</Option>
         <Option name="pix_route_dnat_supported">true</Option>
         <Option name="pix_rule_syslog_settings">false</Option>
         <Option name="pix_security_fragguard_supported">true</Option>
         <Option name="pix_set_communities_from_object_data">False</Option>
         <Option name="pix_set_host_name">True</Option>
-        <Option name="pix_snmp_poll_traps_1"></Option>
-        <Option name="pix_snmp_poll_traps_2"></Option>
-        <Option name="pix_snmp_server1"></Option>
-        <Option name="pix_snmp_server2"></Option>
+        <Option name="pix_snmp_poll_traps_1"/>
+        <Option name="pix_snmp_poll_traps_2"/>
+        <Option name="pix_snmp_server1"/>
+        <Option name="pix_snmp_server2"/>
         <Option name="pix_syslog_device_id_supported">false</Option>
         <Option name="pix_tcpmss">False</Option>
         <Option name="pix_tcpmss_value">0</Option>
         <Option name="pix_use_acl_remarks">true</Option>
         <Option name="pptp_fixup">2 1723 0 nil 0</Option>
         <Option name="prolog_place">top</Option>
-        <Option name="prolog_script"></Option>
+        <Option name="prolog_script"/>
         <Option name="rsh_fixup">2 514 0 nil 0</Option>
         <Option name="rtsp_fixup">2 554 0 nil 0</Option>
-        <Option name="scpArgs"></Option>
+        <Option name="scpArgs"/>
         <Option name="secuwall_add_files">False</Option>
         <Option name="secuwall_add_files_dir">/opt/secuwall/templates/default</Option>
         <Option name="secuwall_dns_reso1">files</Option>
@@ -677,7 +677,7 @@
         <Option name="smtp_fixup">2 25 25 nil 0</Option>
         <Option name="solaris_ip_forward">1</Option>
         <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-        <Option name="sshArgs"></Option>
+        <Option name="sshArgs"/>
         <Option name="tftp_fixup">2 69 0 nil 0</Option>
         <Option name="ulog_cprange">0</Option>
         <Option name="ulog_nlgroup">1</Option>
@@ -715,6 +715,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -1029,6 +1032,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -1217,6 +1223,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -1492,12 +1501,12 @@
           <Interface id="id3814X97641" dedicated_failover="False" dyn="False" label="outside" mgmt="False" network_zone="sysid0" security_level="0" unnum="False" unprotected="False" name="Ethernet0.101" comment="" ro="False">
             <IPv4 id="id3816X97641" name="pix1:Ethernet0:Ethernet0.101:ip" comment="" ro="False" address="192.0.2.253" netmask="255.255.255.0"/>
             <InterfaceOptions>
-              <Option name="bonding_policy"></Option>
-              <Option name="bondng_driver_options"></Option>
+              <Option name="bonding_policy"/>
+              <Option name="bondng_driver_options"/>
               <Option name="enable_stp">False</Option>
               <Option name="type">8021q</Option>
               <Option name="vlan_id">101</Option>
-              <Option name="xmit_hash_policy"></Option>
+              <Option name="xmit_hash_policy"/>
             </InterfaceOptions>
           </Interface>
           <Interface id="id3817X97641" dedicated_failover="False" dyn="False" label="" mgmt="False" network_zone="id11817X97641" security_level="20" unnum="False" unprotected="False" name="Ethernet0.102" comment="" ro="False">
@@ -1522,16 +1531,16 @@
         <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
-          <Option name="action_on_reject"></Option>
-          <Option name="activationCmd"></Option>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="action_on_reject"/>
+          <Option name="activationCmd"/>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="classify_mark_terminating">False</Option>
-          <Option name="cmdline"></Option>
-          <Option name="compiler"></Option>
+          <Option name="cmdline"/>
+          <Option name="compiler"/>
           <Option name="configure_interfaces">True</Option>
           <Option name="configure_vlan_interfaces">True</Option>
           <Option name="conn_hh">0</Option>
@@ -1542,7 +1551,7 @@
           <Option name="dns_fixup">2 65535 0 nil 0</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="eliminate_duplicates">true</Option>
-          <Option name="epilog_script"></Option>
+          <Option name="epilog_script"/>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
@@ -1561,9 +1570,9 @@
           <Option name="icmp_error_fixup">2 0 0 nil 0</Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">2 389 389 nil 0</Option>
-          <Option name="ipt_mangle_only_rulesets"></Option>
+          <Option name="ipt_mangle_only_rulesets"/>
           <Option name="ipv4_6_order">ipv4_first</Option>
-          <Option name="limit_suffix"></Option>
+          <Option name="limit_suffix"/>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">1</Option>
           <Option name="load_modules">True</Option>
@@ -1579,11 +1588,11 @@
           <Option name="macosx_ip_forward">1</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"></Option>
+          <Option name="mgmt_addr"/>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modules_dir">/lib/modules/`uname -r`/kernel/net/</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
           <Option name="pf_timeout_frag">30</Option>
@@ -1591,7 +1600,7 @@
           <Option name="pix_acl_basic">True</Option>
           <Option name="pix_acl_no_clear">False</Option>
           <Option name="pix_acl_substitution">False</Option>
-          <Option name="pix_acl_temp_addr"></Option>
+          <Option name="pix_acl_temp_addr"/>
           <Option name="pix_add_clear_statements">true</Option>
           <Option name="pix_assume_fw_part_of_any">True</Option>
           <Option name="pix_check_duplicate_nat">False</Option>
@@ -1605,7 +1614,7 @@
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
           <Option name="pix_enable_snmp_traps">False</Option>
-          <Option name="pix_epilog_script"></Option>
+          <Option name="pix_epilog_script"/>
           <Option name="pix_floodguard">True</Option>
           <Option name="pix_fragguard">False</Option>
           <Option name="pix_generate_out_acl">True</Option>
@@ -1620,14 +1629,14 @@
           <Option name="pix_max_conns">0</Option>
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
-          <Option name="pix_ntp1"></Option>
+          <Option name="pix_ntp1"/>
           <Option name="pix_ntp1_pref">False</Option>
-          <Option name="pix_ntp2"></Option>
+          <Option name="pix_ntp2"/>
           <Option name="pix_ntp2_pref">False</Option>
-          <Option name="pix_ntp3"></Option>
+          <Option name="pix_ntp3"/>
           <Option name="pix_ntp3_pref">False</Option>
           <Option name="pix_optimize_default_nat">False</Option>
-          <Option name="pix_prolog_script"></Option>
+          <Option name="pix_prolog_script"/>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">False</Option>
           <Option name="pix_resetinbound">False</Option>
@@ -1638,16 +1647,16 @@
           <Option name="pix_security_fragguard_supported">true</Option>
           <Option name="pix_set_communities_from_object_data">False</Option>
           <Option name="pix_set_host_name">True</Option>
-          <Option name="pix_snmp_poll_traps_1"></Option>
-          <Option name="pix_snmp_poll_traps_2"></Option>
-          <Option name="pix_snmp_server1"></Option>
-          <Option name="pix_snmp_server2"></Option>
+          <Option name="pix_snmp_poll_traps_1"/>
+          <Option name="pix_snmp_poll_traps_2"/>
+          <Option name="pix_snmp_server1"/>
+          <Option name="pix_snmp_server2"/>
           <Option name="pix_ssh_timeout">0</Option>
-          <Option name="pix_syslog_device_id_opt"></Option>
+          <Option name="pix_syslog_device_id_opt"/>
           <Option name="pix_syslog_device_id_supported">false</Option>
-          <Option name="pix_syslog_device_id_val"></Option>
-          <Option name="pix_syslog_facility"></Option>
-          <Option name="pix_syslog_host"></Option>
+          <Option name="pix_syslog_device_id_val"/>
+          <Option name="pix_syslog_facility"/>
+          <Option name="pix_syslog_host"/>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_tcpmss">False</Option>
           <Option name="pix_tcpmss_value">0</Option>
@@ -1656,13 +1665,13 @@
           <Option name="pix_use_manual_commit">False</Option>
           <Option name="pptp_fixup">2 1723 0 nil 0</Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"></Option>
+          <Option name="prolog_script"/>
           <Option name="rpc_hh">0</Option>
           <Option name="rpc_mm">0</Option>
           <Option name="rpc_ss">0</Option>
           <Option name="rsh_fixup">2 514 0 nil 0</Option>
           <Option name="rtsp_fixup">2 554 0 nil 0</Option>
-          <Option name="scpArgs"></Option>
+          <Option name="scpArgs"/>
           <Option name="secuwall_add_files">False</Option>
           <Option name="secuwall_add_files_dir">/opt/secuwall/templates/default</Option>
           <Option name="secuwall_dns_reso1">files</Option>
@@ -1678,7 +1687,7 @@
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
           <Option name="solaris_ip_forward">1</Option>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
           <Option name="uauth_abs">False</Option>
           <Option name="uauth_hh">0</Option>
@@ -1725,12 +1734,12 @@
           <Interface id="id2818X95537" dedicated_failover="False" dyn="False" label="outside" mgmt="False" network_zone="sysid0" security_level="0" unnum="False" unprotected="False" name="Ethernet0.101" comment="" ro="False">
             <IPv4 id="id2826X97641" name="pix2:Ethernet0:Ethernet0.101:ip" comment="" ro="False" address="192.0.2.254" netmask="255.255.255.0"/>
             <InterfaceOptions>
-              <Option name="bonding_policy"></Option>
-              <Option name="bondng_driver_options"></Option>
+              <Option name="bonding_policy"/>
+              <Option name="bondng_driver_options"/>
               <Option name="enable_stp">False</Option>
               <Option name="type">8021q</Option>
               <Option name="vlan_id">101</Option>
-              <Option name="xmit_hash_policy"></Option>
+              <Option name="xmit_hash_policy"/>
             </InterfaceOptions>
           </Interface>
           <Interface id="id3315X97641" dedicated_failover="False" dyn="False" label="" mgmt="False" network_zone="id11817X97641" security_level="20" unnum="False" unprotected="False" name="Ethernet0.102" comment="" ro="False">
@@ -1755,16 +1764,16 @@
         <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
-          <Option name="action_on_reject"></Option>
-          <Option name="activationCmd"></Option>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="action_on_reject"/>
+          <Option name="activationCmd"/>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="classify_mark_terminating">False</Option>
-          <Option name="cmdline"></Option>
-          <Option name="compiler"></Option>
+          <Option name="cmdline"/>
+          <Option name="compiler"/>
           <Option name="configure_interfaces">True</Option>
           <Option name="configure_vlan_interfaces">True</Option>
           <Option name="conn_hh">0</Option>
@@ -1775,7 +1784,7 @@
           <Option name="dns_fixup">2 65535 0 nil 0</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="eliminate_duplicates">true</Option>
-          <Option name="epilog_script"></Option>
+          <Option name="epilog_script"/>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
@@ -1794,9 +1803,9 @@
           <Option name="icmp_error_fixup">2 0 0 nil 0</Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">2 389 389 nil 0</Option>
-          <Option name="ipt_mangle_only_rulesets"></Option>
+          <Option name="ipt_mangle_only_rulesets"/>
           <Option name="ipv4_6_order">ipv4_first</Option>
-          <Option name="limit_suffix"></Option>
+          <Option name="limit_suffix"/>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">1</Option>
           <Option name="load_modules">True</Option>
@@ -1812,11 +1821,11 @@
           <Option name="macosx_ip_forward">1</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"></Option>
+          <Option name="mgmt_addr"/>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modules_dir">/lib/modules/`uname -r`/kernel/net/</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
           <Option name="pf_timeout_frag">30</Option>
@@ -1824,7 +1833,7 @@
           <Option name="pix_acl_basic">True</Option>
           <Option name="pix_acl_no_clear">False</Option>
           <Option name="pix_acl_substitution">False</Option>
-          <Option name="pix_acl_temp_addr"></Option>
+          <Option name="pix_acl_temp_addr"/>
           <Option name="pix_add_clear_statements">true</Option>
           <Option name="pix_assume_fw_part_of_any">True</Option>
           <Option name="pix_check_duplicate_nat">False</Option>
@@ -1838,7 +1847,7 @@
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
           <Option name="pix_enable_snmp_traps">False</Option>
-          <Option name="pix_epilog_script"></Option>
+          <Option name="pix_epilog_script"/>
           <Option name="pix_floodguard">True</Option>
           <Option name="pix_fragguard">False</Option>
           <Option name="pix_generate_out_acl">True</Option>
@@ -1853,14 +1862,14 @@
           <Option name="pix_max_conns">0</Option>
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
-          <Option name="pix_ntp1"></Option>
+          <Option name="pix_ntp1"/>
           <Option name="pix_ntp1_pref">False</Option>
-          <Option name="pix_ntp2"></Option>
+          <Option name="pix_ntp2"/>
           <Option name="pix_ntp2_pref">False</Option>
-          <Option name="pix_ntp3"></Option>
+          <Option name="pix_ntp3"/>
           <Option name="pix_ntp3_pref">False</Option>
           <Option name="pix_optimize_default_nat">False</Option>
-          <Option name="pix_prolog_script"></Option>
+          <Option name="pix_prolog_script"/>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">False</Option>
           <Option name="pix_resetinbound">False</Option>
@@ -1871,16 +1880,16 @@
           <Option name="pix_security_fragguard_supported">true</Option>
           <Option name="pix_set_communities_from_object_data">False</Option>
           <Option name="pix_set_host_name">True</Option>
-          <Option name="pix_snmp_poll_traps_1"></Option>
-          <Option name="pix_snmp_poll_traps_2"></Option>
-          <Option name="pix_snmp_server1"></Option>
-          <Option name="pix_snmp_server2"></Option>
+          <Option name="pix_snmp_poll_traps_1"/>
+          <Option name="pix_snmp_poll_traps_2"/>
+          <Option name="pix_snmp_server1"/>
+          <Option name="pix_snmp_server2"/>
           <Option name="pix_ssh_timeout">0</Option>
-          <Option name="pix_syslog_device_id_opt"></Option>
+          <Option name="pix_syslog_device_id_opt"/>
           <Option name="pix_syslog_device_id_supported">false</Option>
-          <Option name="pix_syslog_device_id_val"></Option>
-          <Option name="pix_syslog_facility"></Option>
-          <Option name="pix_syslog_host"></Option>
+          <Option name="pix_syslog_device_id_val"/>
+          <Option name="pix_syslog_facility"/>
+          <Option name="pix_syslog_host"/>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_tcpmss">False</Option>
           <Option name="pix_tcpmss_value">0</Option>
@@ -1889,13 +1898,13 @@
           <Option name="pix_use_manual_commit">False</Option>
           <Option name="pptp_fixup">2 1723 0 nil 0</Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"></Option>
+          <Option name="prolog_script"/>
           <Option name="rpc_hh">0</Option>
           <Option name="rpc_mm">0</Option>
           <Option name="rpc_ss">0</Option>
           <Option name="rsh_fixup">2 514 0 nil 0</Option>
           <Option name="rtsp_fixup">2 554 0 nil 0</Option>
-          <Option name="scpArgs"></Option>
+          <Option name="scpArgs"/>
           <Option name="secuwall_add_files">False</Option>
           <Option name="secuwall_add_files_dir">/opt/secuwall/templates/default</Option>
           <Option name="secuwall_dns_reso1">files</Option>
@@ -1911,7 +1920,7 @@
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
           <Option name="solaris_ip_forward">1</Option>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
           <Option name="uauth_abs">False</Option>
           <Option name="uauth_hh">0</Option>
@@ -1971,16 +1980,16 @@
         <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
-          <Option name="action_on_reject"></Option>
-          <Option name="activationCmd"></Option>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="action_on_reject"/>
+          <Option name="activationCmd"/>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="classify_mark_terminating">False</Option>
-          <Option name="cmdline"></Option>
-          <Option name="compiler"></Option>
+          <Option name="cmdline"/>
+          <Option name="compiler"/>
           <Option name="configure_interfaces">True</Option>
           <Option name="configure_vlan_interfaces">True</Option>
           <Option name="ctiqbe_fixup">2 2748 0 nil 0</Option>
@@ -1988,7 +1997,7 @@
           <Option name="dns_fixup">2 65535 0 nil 0</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="eliminate_duplicates">true</Option>
-          <Option name="epilog_script"></Option>
+          <Option name="epilog_script"/>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
@@ -2001,9 +2010,9 @@
           <Option name="icmp_error_fixup">2 0 0 nil 0</Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">2 389 389 nil 0</Option>
-          <Option name="ipt_mangle_only_rulesets"></Option>
+          <Option name="ipt_mangle_only_rulesets"/>
           <Option name="ipv4_6_order">ipv4_first</Option>
-          <Option name="limit_suffix"></Option>
+          <Option name="limit_suffix"/>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">1</Option>
           <Option name="load_modules">True</Option>
@@ -2019,11 +2028,11 @@
           <Option name="macosx_ip_forward">1</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"></Option>
+          <Option name="mgmt_addr"/>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modules_dir">/lib/modules/`uname -r`/kernel/net/</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
           <Option name="pf_timeout_frag">30</Option>
@@ -2039,31 +2048,31 @@
           <Option name="pix_floodguard">true</Option>
           <Option name="pix_include_comments">true</Option>
           <Option name="pix_ip_address">True</Option>
-          <Option name="pix_ntp1"></Option>
+          <Option name="pix_ntp1"/>
           <Option name="pix_ntp1_pref">False</Option>
-          <Option name="pix_ntp2"></Option>
+          <Option name="pix_ntp2"/>
           <Option name="pix_ntp2_pref">False</Option>
-          <Option name="pix_ntp3"></Option>
+          <Option name="pix_ntp3"/>
           <Option name="pix_ntp3_pref">False</Option>
           <Option name="pix_route_dnat_supported">true</Option>
           <Option name="pix_rule_syslog_settings">false</Option>
           <Option name="pix_security_fragguard_supported">true</Option>
           <Option name="pix_set_communities_from_object_data">False</Option>
           <Option name="pix_set_host_name">True</Option>
-          <Option name="pix_snmp_poll_traps_1"></Option>
-          <Option name="pix_snmp_poll_traps_2"></Option>
-          <Option name="pix_snmp_server1"></Option>
-          <Option name="pix_snmp_server2"></Option>
+          <Option name="pix_snmp_poll_traps_1"/>
+          <Option name="pix_snmp_poll_traps_2"/>
+          <Option name="pix_snmp_server1"/>
+          <Option name="pix_snmp_server2"/>
           <Option name="pix_syslog_device_id_supported">false</Option>
           <Option name="pix_tcpmss">False</Option>
           <Option name="pix_tcpmss_value">0</Option>
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="pptp_fixup">2 1723 0 nil 0</Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"></Option>
+          <Option name="prolog_script"/>
           <Option name="rsh_fixup">2 514 0 nil 0</Option>
           <Option name="rtsp_fixup">2 554 0 nil 0</Option>
-          <Option name="scpArgs"></Option>
+          <Option name="scpArgs"/>
           <Option name="secuwall_add_files">False</Option>
           <Option name="secuwall_add_files_dir">/opt/secuwall/templates/default</Option>
           <Option name="secuwall_dns_reso1">files</Option>
@@ -2073,7 +2082,7 @@
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
           <Option name="solaris_ip_forward">1</Option>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
@@ -2122,16 +2131,16 @@
         <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
-          <Option name="action_on_reject"></Option>
-          <Option name="activationCmd"></Option>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="action_on_reject"/>
+          <Option name="activationCmd"/>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="classify_mark_terminating">False</Option>
-          <Option name="cmdline"></Option>
-          <Option name="compiler"></Option>
+          <Option name="cmdline"/>
+          <Option name="compiler"/>
           <Option name="configure_interfaces">True</Option>
           <Option name="configure_vlan_interfaces">True</Option>
           <Option name="ctiqbe_fixup">2 2748 0 nil 0</Option>
@@ -2139,7 +2148,7 @@
           <Option name="dns_fixup">2 65535 0 nil 0</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="eliminate_duplicates">true</Option>
-          <Option name="epilog_script"></Option>
+          <Option name="epilog_script"/>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
@@ -2152,9 +2161,9 @@
           <Option name="icmp_error_fixup">2 0 0 nil 0</Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">2 389 389 nil 0</Option>
-          <Option name="ipt_mangle_only_rulesets"></Option>
+          <Option name="ipt_mangle_only_rulesets"/>
           <Option name="ipv4_6_order">ipv4_first</Option>
-          <Option name="limit_suffix"></Option>
+          <Option name="limit_suffix"/>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">1</Option>
           <Option name="load_modules">True</Option>
@@ -2170,11 +2179,11 @@
           <Option name="macosx_ip_forward">1</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"></Option>
+          <Option name="mgmt_addr"/>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modules_dir">/lib/modules/`uname -r`/kernel/net/</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
           <Option name="pf_timeout_frag">30</Option>
@@ -2190,31 +2199,31 @@
           <Option name="pix_floodguard">true</Option>
           <Option name="pix_include_comments">true</Option>
           <Option name="pix_ip_address">True</Option>
-          <Option name="pix_ntp1"></Option>
+          <Option name="pix_ntp1"/>
           <Option name="pix_ntp1_pref">False</Option>
-          <Option name="pix_ntp2"></Option>
+          <Option name="pix_ntp2"/>
           <Option name="pix_ntp2_pref">False</Option>
-          <Option name="pix_ntp3"></Option>
+          <Option name="pix_ntp3"/>
           <Option name="pix_ntp3_pref">False</Option>
           <Option name="pix_route_dnat_supported">true</Option>
           <Option name="pix_rule_syslog_settings">false</Option>
           <Option name="pix_security_fragguard_supported">true</Option>
           <Option name="pix_set_communities_from_object_data">False</Option>
           <Option name="pix_set_host_name">True</Option>
-          <Option name="pix_snmp_poll_traps_1"></Option>
-          <Option name="pix_snmp_poll_traps_2"></Option>
-          <Option name="pix_snmp_server1"></Option>
-          <Option name="pix_snmp_server2"></Option>
+          <Option name="pix_snmp_poll_traps_1"/>
+          <Option name="pix_snmp_poll_traps_2"/>
+          <Option name="pix_snmp_server1"/>
+          <Option name="pix_snmp_server2"/>
           <Option name="pix_syslog_device_id_supported">false</Option>
           <Option name="pix_tcpmss">False</Option>
           <Option name="pix_tcpmss_value">0</Option>
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="pptp_fixup">2 1723 0 nil 0</Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"></Option>
+          <Option name="prolog_script"/>
           <Option name="rsh_fixup">2 514 0 nil 0</Option>
           <Option name="rtsp_fixup">2 554 0 nil 0</Option>
-          <Option name="scpArgs"></Option>
+          <Option name="scpArgs"/>
           <Option name="secuwall_add_files">False</Option>
           <Option name="secuwall_add_files_dir">/opt/secuwall/templates/default</Option>
           <Option name="secuwall_dns_reso1">files</Option>
@@ -2224,7 +2233,7 @@
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
           <Option name="solaris_ip_forward">1</Option>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
diff --git a/test/pix/objects-for-regression-tests.fwb b/test/pix/objects-for-regression-tests.fwb
index d7af81bec..5e3c1b8a3 100644
--- a/test/pix/objects-for-regression-tests.fwb
+++ b/test/pix/objects-for-regression-tests.fwb
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
-<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="17" lastModified="1295466874" id="root">
+<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="18" lastModified="1295466874" id="root">
   <Library id="syslib000" color="#d4f8ff" name="Standard" comment="Standard objects" ro="True">
     <AnyNetwork id="sysid0" name="Any" comment="Any Network" ro="False" address="0.0.0.0" netmask="0.0.0.0"/>
     <AnyIPService id="sysid1" protocol_num="0" name="Any" comment="Any IP Service" ro="False"/>
@@ -51,9 +51,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"></Option>
-            <Option name="snmp_description"></Option>
-            <Option name="snmp_location"></Option>
+            <Option name="snmp_contact"/>
+            <Option name="snmp_description"/>
+            <Option name="snmp_location"/>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -69,9 +69,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"></Option>
-            <Option name="snmp_description"></Option>
-            <Option name="snmp_location"></Option>
+            <Option name="snmp_contact"/>
+            <Option name="snmp_description"/>
+            <Option name="snmp_location"/>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -100,17 +100,17 @@
     </ObjectGroup>
     <ServiceGroup id="stdid05" name="Services" comment="" ro="False">
       <CustomService id="stdid14_1" name="ESTABLISHED" comment="This service matches all packets which are part of network connections established through the firewall, or connections 'related' to those established through the firewall. Term 'established' refers to the state tracking mechanism which exists inside iptables and other stateful firewalls and does not mean any particular combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful inspection module made appropriate record in the state table. Usually stateful firewalls keep track of network connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' describes packet belonging to a separate network connection, related to the session firewall is keeping track of. One example is FTP command and FTP data sessions." ro="False" protocol="any" address_family="ipv4">
-        <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+        <CustomServiceCommand platform="Undefined"/>
         <CustomServiceCommand platform="iosacl">established</CustomServiceCommand>
-        <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+        <CustomServiceCommand platform="ipfilter"/>
         <CustomServiceCommand platform="ipfw">established</CustomServiceCommand>
         <CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
         <CustomServiceCommand platform="procurve_acl">established</CustomServiceCommand>
       </CustomService>
       <CustomService id="stdid14_2" name="ESTABLISHED ipv6" comment="This service matches all packets which are part of network connections established through the firewall, or connections 'related' to those established through the firewall. Term 'established' refers to the state tracking mechanism which exists inside iptables and other stateful firewalls and does not mean any particular combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful inspection module made appropriate record in the state table. Usually stateful firewalls keep track of network connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' describes packet belonging to a separate network connection, related to the session firewall is keeping track of. One example is FTP command and FTP data sessions." ro="False" protocol="any" address_family="ipv6">
-        <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+        <CustomServiceCommand platform="Undefined"/>
         <CustomServiceCommand platform="iosacl">established</CustomServiceCommand>
-        <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+        <CustomServiceCommand platform="ipfilter"/>
         <CustomServiceCommand platform="ipfw">established</CustomServiceCommand>
         <CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
         <CustomServiceCommand platform="procurve_acl">established</CustomServiceCommand>
@@ -360,54 +360,54 @@
       </ServiceGroup>
       <ServiceGroup id="stdid13" name="Custom" comment="" ro="False">
         <CustomService id="id3B64EEA8" name="rpc" comment="works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
+          <CustomServiceCommand platform="Undefined"/>
+          <CustomServiceCommand platform="ipf"/>
+          <CustomServiceCommand platform="ipfilter"/>
+          <CustomServiceCommand platform="ipfw"/>
           <CustomServiceCommand platform="iptables">-m record_rpc</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"></CustomServiceCommand>
-          <CustomServiceCommand platform="pix"></CustomServiceCommand>
-          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
+          <CustomServiceCommand platform="pf"/>
+          <CustomServiceCommand platform="pix"/>
+          <CustomServiceCommand platform="unknown"/>
         </CustomService>
         <CustomService id="id3B64EF4E" name="irc-conn" comment="IRC connection tracker, supports DCC.&#10;Works on iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/&#10;" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
+          <CustomServiceCommand platform="Undefined"/>
+          <CustomServiceCommand platform="ipf"/>
+          <CustomServiceCommand platform="ipfilter"/>
+          <CustomServiceCommand platform="ipfw"/>
           <CustomServiceCommand platform="iptables">-m irc</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"></CustomServiceCommand>
-          <CustomServiceCommand platform="pix"></CustomServiceCommand>
-          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
+          <CustomServiceCommand platform="pf"/>
+          <CustomServiceCommand platform="pix"/>
+          <CustomServiceCommand platform="unknown"/>
         </CustomService>
         <CustomService id="id3B64EF50" name="psd" comment="Port scan detector, works only on iptables and  requires patch-o-matic &#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
+          <CustomServiceCommand platform="Undefined"/>
+          <CustomServiceCommand platform="ipf"/>
+          <CustomServiceCommand platform="ipfilter"/>
+          <CustomServiceCommand platform="ipfw"/>
           <CustomServiceCommand platform="iptables">-m psd --psd-weight-threshold 5 --psd-delay-threshold 10000</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"></CustomServiceCommand>
-          <CustomServiceCommand platform="pix"></CustomServiceCommand>
-          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
+          <CustomServiceCommand platform="pf"/>
+          <CustomServiceCommand platform="pix"/>
+          <CustomServiceCommand platform="unknown"/>
         </CustomService>
         <CustomService id="id3B64EF52" name="string" comment="Matches a string in a whole packet, works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
+          <CustomServiceCommand platform="Undefined"/>
+          <CustomServiceCommand platform="ipf"/>
+          <CustomServiceCommand platform="ipfilter"/>
+          <CustomServiceCommand platform="ipfw"/>
           <CustomServiceCommand platform="iptables">-m string --string test_pattern</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"></CustomServiceCommand>
-          <CustomServiceCommand platform="pix"></CustomServiceCommand>
-          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
+          <CustomServiceCommand platform="pf"/>
+          <CustomServiceCommand platform="pix"/>
+          <CustomServiceCommand platform="unknown"/>
         </CustomService>
         <CustomService id="id3B64EF54" name="talk" comment="Talk protocol support. Works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
+          <CustomServiceCommand platform="Undefined"/>
+          <CustomServiceCommand platform="ipf"/>
+          <CustomServiceCommand platform="ipfilter"/>
+          <CustomServiceCommand platform="ipfw"/>
           <CustomServiceCommand platform="iptables">-m talk</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"></CustomServiceCommand>
-          <CustomServiceCommand platform="pix"></CustomServiceCommand>
-          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
+          <CustomServiceCommand platform="pf"/>
+          <CustomServiceCommand platform="pix"/>
+          <CustomServiceCommand platform="unknown"/>
         </CustomService>
       </ServiceGroup>
       <ServiceGroup id="stdid19" name="TagServices" comment="" ro="False"/>
@@ -568,9 +568,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"></Option>
-            <Option name="snmp_description"></Option>
-            <Option name="snmp_location"></Option>
+            <Option name="snmp_contact"/>
+            <Option name="snmp_description"/>
+            <Option name="snmp_location"/>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -637,9 +637,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"></Option>
-            <Option name="snmp_description"></Option>
-            <Option name="snmp_location"></Option>
+            <Option name="snmp_contact"/>
+            <Option name="snmp_description"/>
+            <Option name="snmp_location"/>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -655,9 +655,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"></Option>
-            <Option name="snmp_description"></Option>
-            <Option name="snmp_location"></Option>
+            <Option name="snmp_contact"/>
+            <Option name="snmp_description"/>
+            <Option name="snmp_location"/>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
@@ -672,9 +672,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"></Option>
-            <Option name="snmp_description"></Option>
-            <Option name="snmp_location"></Option>
+            <Option name="snmp_contact"/>
+            <Option name="snmp_description"/>
+            <Option name="snmp_location"/>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -690,9 +690,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"></Option>
-            <Option name="snmp_description"></Option>
-            <Option name="snmp_location"></Option>
+            <Option name="snmp_contact"/>
+            <Option name="snmp_description"/>
+            <Option name="snmp_location"/>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -708,9 +708,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"></Option>
-            <Option name="snmp_description"></Option>
-            <Option name="snmp_location"></Option>
+            <Option name="snmp_contact"/>
+            <Option name="snmp_description"/>
+            <Option name="snmp_location"/>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -726,9 +726,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"></Option>
-            <Option name="snmp_description"></Option>
-            <Option name="snmp_location"></Option>
+            <Option name="snmp_contact"/>
+            <Option name="snmp_description"/>
+            <Option name="snmp_location"/>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -744,9 +744,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"></Option>
-            <Option name="snmp_description"></Option>
-            <Option name="snmp_location"></Option>
+            <Option name="snmp_contact"/>
+            <Option name="snmp_description"/>
+            <Option name="snmp_location"/>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -776,9 +776,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"></Option>
-            <Option name="snmp_description"></Option>
-            <Option name="snmp_location"></Option>
+            <Option name="snmp_contact"/>
+            <Option name="snmp_description"/>
+            <Option name="snmp_location"/>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -794,9 +794,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"></Option>
-            <Option name="snmp_description"></Option>
-            <Option name="snmp_location"></Option>
+            <Option name="snmp_contact"/>
+            <Option name="snmp_description"/>
+            <Option name="snmp_location"/>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -812,9 +812,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"></Option>
-            <Option name="snmp_description"></Option>
-            <Option name="snmp_location"></Option>
+            <Option name="snmp_contact"/>
+            <Option name="snmp_description"/>
+            <Option name="snmp_location"/>
             <Option name="use_mac_addr">False</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -830,9 +830,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"></Option>
-            <Option name="snmp_description"></Option>
-            <Option name="snmp_location"></Option>
+            <Option name="snmp_contact"/>
+            <Option name="snmp_description"/>
+            <Option name="snmp_location"/>
             <Option name="use_mac_addr">False</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -848,9 +848,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"></Option>
-            <Option name="snmp_description"></Option>
-            <Option name="snmp_location"></Option>
+            <Option name="snmp_contact"/>
+            <Option name="snmp_description"/>
+            <Option name="snmp_location"/>
             <Option name="use_mac_addr">False</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -866,9 +866,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"></Option>
-            <Option name="snmp_description"></Option>
-            <Option name="snmp_location"></Option>
+            <Option name="snmp_contact"/>
+            <Option name="snmp_description"/>
+            <Option name="snmp_location"/>
             <Option name="use_mac_addr">False</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -884,9 +884,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"></Option>
-            <Option name="snmp_description"></Option>
-            <Option name="snmp_location"></Option>
+            <Option name="snmp_contact"/>
+            <Option name="snmp_description"/>
+            <Option name="snmp_location"/>
             <Option name="use_mac_addr">False</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -898,9 +898,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"></Option>
-            <Option name="snmp_description"></Option>
-            <Option name="snmp_location"></Option>
+            <Option name="snmp_contact"/>
+            <Option name="snmp_description"/>
+            <Option name="snmp_location"/>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -932,9 +932,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"></Option>
-            <Option name="snmp_description"></Option>
-            <Option name="snmp_location"></Option>
+            <Option name="snmp_contact"/>
+            <Option name="snmp_description"/>
+            <Option name="snmp_location"/>
             <Option name="use_mac_addr_filter">True</Option>
           </HostOptions>
         </Host>
@@ -949,9 +949,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"></Option>
-            <Option name="snmp_description"></Option>
-            <Option name="snmp_location"></Option>
+            <Option name="snmp_contact"/>
+            <Option name="snmp_description"/>
+            <Option name="snmp_location"/>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
@@ -966,9 +966,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"></Option>
-            <Option name="snmp_description"></Option>
-            <Option name="snmp_location"></Option>
+            <Option name="snmp_contact"/>
+            <Option name="snmp_description"/>
+            <Option name="snmp_location"/>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
@@ -997,9 +997,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"></Option>
-            <Option name="snmp_description"></Option>
-            <Option name="snmp_location"></Option>
+            <Option name="snmp_contact"/>
+            <Option name="snmp_description"/>
+            <Option name="snmp_location"/>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -1061,9 +1061,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"></Option>
-            <Option name="snmp_description"></Option>
-            <Option name="snmp_location"></Option>
+            <Option name="snmp_contact"/>
+            <Option name="snmp_description"/>
+            <Option name="snmp_location"/>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -1079,9 +1079,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"></Option>
-            <Option name="snmp_description"></Option>
-            <Option name="snmp_location"></Option>
+            <Option name="snmp_contact"/>
+            <Option name="snmp_description"/>
+            <Option name="snmp_location"/>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
@@ -1096,9 +1096,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"></Option>
-            <Option name="snmp_description"></Option>
-            <Option name="snmp_location"></Option>
+            <Option name="snmp_contact"/>
+            <Option name="snmp_description"/>
+            <Option name="snmp_location"/>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
@@ -1113,9 +1113,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"></Option>
-            <Option name="snmp_description"></Option>
-            <Option name="snmp_location"></Option>
+            <Option name="snmp_contact"/>
+            <Option name="snmp_description"/>
+            <Option name="snmp_location"/>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
@@ -1176,9 +1176,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"></Option>
-            <Option name="snmp_description"></Option>
-            <Option name="snmp_location"></Option>
+            <Option name="snmp_contact"/>
+            <Option name="snmp_description"/>
+            <Option name="snmp_location"/>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
@@ -1195,9 +1195,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"></Option>
-            <Option name="snmp_description"></Option>
-            <Option name="snmp_location"></Option>
+            <Option name="snmp_contact"/>
+            <Option name="snmp_description"/>
+            <Option name="snmp_location"/>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
@@ -1373,31 +1373,31 @@
       </ServiceGroup>
       <ServiceGroup id="stdid13_1" name="Custom" comment="" ro="False">
         <CustomService id="id3B64FE22" name="talk" comment="Talk support" ro="False" protocol="any" address_family="ipv4">
-          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="Undefined"/>
+          <CustomServiceCommand platform="ipfilter"/>
           <CustomServiceCommand platform="iptables">-m ip_conntrack_talk -m ip_nat_talk</CustomServiceCommand>
         </CustomService>
         <CustomService id="id21571X21575" name="custom serv 1" comment="" ro="False" protocol="tcp" address_family="ipv4">
-          <CustomServiceCommand platform="fwsm"></CustomServiceCommand>
-          <CustomServiceCommand platform="iosacl"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
-          <CustomServiceCommand platform="iptables"></CustomServiceCommand>
-          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="fwsm"/>
+          <CustomServiceCommand platform="iosacl"/>
+          <CustomServiceCommand platform="ipf"/>
+          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="iptables"/>
+          <CustomServiceCommand platform="pf"/>
           <CustomServiceCommand platform="pix">tcp destination neq 8080</CustomServiceCommand>
-          <CustomServiceCommand platform="procurve_acl"></CustomServiceCommand>
-          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
+          <CustomServiceCommand platform="procurve_acl"/>
+          <CustomServiceCommand platform="unknown"/>
         </CustomService>
         <CustomService id="id80355X18586" name="custom serv 2" comment="" ro="False" protocol="tcp" address_family="ipv4">
-          <CustomServiceCommand platform="fwsm"></CustomServiceCommand>
-          <CustomServiceCommand platform="iosacl"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
-          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
-          <CustomServiceCommand platform="iptables"></CustomServiceCommand>
-          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="fwsm"/>
+          <CustomServiceCommand platform="iosacl"/>
+          <CustomServiceCommand platform="ipf"/>
+          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="iptables"/>
+          <CustomServiceCommand platform="pf"/>
           <CustomServiceCommand platform="pix">neq 8080</CustomServiceCommand>
-          <CustomServiceCommand platform="procurve_acl"></CustomServiceCommand>
-          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
+          <CustomServiceCommand platform="procurve_acl"/>
+          <CustomServiceCommand platform="unknown"/>
         </CustomService>
       </ServiceGroup>
       <ServiceGroup id="stdid05_1_userservices" name="Users" comment="" ro="False"/>
@@ -1424,6 +1424,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3D19635C" disabled="False" position="1" action="Translate" comment="">
@@ -1445,6 +1448,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3DB6442D" disabled="False" position="2" action="Translate" comment="">
@@ -1466,6 +1472,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3D1969CD" disabled="False" position="3" action="Translate" comment="">
@@ -1487,6 +1496,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3D1967DE" disabled="False" position="4" action="Translate" comment="">
@@ -1508,6 +1520,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="nat-firewall2-1" disabled="False" position="5" action="Translate" comment="">
@@ -1529,6 +1544,9 @@
             <TSrv neg="False">
               <ServiceRef ref="tcp-SMTP"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3D1965E7" disabled="False" position="6" action="Translate" comment="">
@@ -1550,6 +1568,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3D19629B" disabled="False" position="7" action="Translate" comment="">
@@ -1571,6 +1592,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3D1964AF" disabled="False" position="8" action="Translate" comment="">
@@ -1596,6 +1620,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3DB63E17" disabled="False" position="9" action="Translate" comment="">
@@ -1617,6 +1644,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3D50AD38" disabled="False" position="10" action="Translate" comment="">
@@ -1638,6 +1668,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3D50ADE4" disabled="False" position="11" action="Translate" comment="">
@@ -1659,6 +1692,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3CDB43B8" disabled="True" position="12" action="Translate" comment="">
@@ -1680,6 +1716,9 @@
             <TSrv neg="False">
               <ServiceRef ref="id3B4FF09A"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -1832,10 +1871,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
+              <Option name="action_on_reject"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"></Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_limit_suffix"/>
+              <Option name="log_prefix"/>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
@@ -1874,10 +1913,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3CE59C76" disabled="False" log="True" position="10" action="Accept" direction="Both" comment="">
@@ -1898,10 +1937,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
+              <Option name="action_on_reject"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"></Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_limit_suffix"/>
+              <Option name="log_prefix"/>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
@@ -1944,10 +1983,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3E155E82" disabled="False" log="False" position="13" action="Accept" direction="Both" comment="">
@@ -2023,10 +2062,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3CD8770E" disabled="False" log="False" position="17" action="Accept" direction="Both" comment="">
@@ -2047,10 +2086,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="pol-firewall2-4" disabled="False" log="False" position="18" action="Accept" direction="Both" comment="">
@@ -2071,10 +2110,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id431BE7A0" disabled="False" log="False" position="19" action="Accept" direction="Both" comment="objects hostA and hostB are&#10;redundant and should be removed by&#10; removeRedundantAddressesFromDst">
@@ -2097,10 +2136,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id431BD5EF" disabled="False" log="False" position="20" action="Accept" direction="Both" comment="">
@@ -2138,10 +2177,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3CE591F6" disabled="True" log="False" position="22" action="Accept" direction="Both" comment="">
@@ -2161,10 +2200,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3B58E180" disabled="False" log="True" position="23" action="Accept" direction="Both" comment="">
@@ -2203,10 +2242,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="pol-firewall2-7" disabled="False" log="True" position="25" action="Deny" direction="Both" comment="">
@@ -2226,11 +2265,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"></Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_limit_suffix"/>
+              <Option name="log_prefix"/>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
@@ -2368,12 +2407,12 @@
           <Option name="accept_established">False</Option>
           <Option name="accept_new_tcp_with_no_syn">False</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="check_shading">True</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="cmdline">-v</Option>
-          <Option name="compiler"></Option>
+          <Option name="compiler"/>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -2382,8 +2421,8 @@
           <Option name="dns_fixup">2 65535 0 nil 0</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
-          <Option name="filesystem"></Option>
-          <Option name="firewall_dir"></Option>
+          <Option name="filesystem"/>
+          <Option name="firewall_dir"/>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ftp_fixup">0 21 0 strict 0</Option>
@@ -2400,9 +2439,9 @@
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">0 389 389 nil 0</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"></Option>
-          <Option name="inst_script"></Option>
-          <Option name="install_script"></Option>
+          <Option name="inst_cmdline"/>
+          <Option name="inst_script"/>
+          <Option name="install_script"/>
           <Option name="ipv4_6_order">ipv4_first</Option>
           <Option name="limit_suffix">/second</Option>
           <Option name="limit_value">0</Option>
@@ -2415,7 +2454,7 @@
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"></Option>
+          <Option name="log_prefix"/>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
@@ -2429,7 +2468,7 @@
           <Option name="openbsd_ip_forward">1</Option>
           <Option name="openbsd_ip_redirect">0</Option>
           <Option name="openbsd_ip_sourceroute">0</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="pass_all_out">False</Option>
           <Option name="pix_acl_basic">False</Option>
           <Option name="pix_acl_no_clear">False</Option>
@@ -2453,7 +2492,7 @@
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
           <Option name="pix_enable_snmp_traps">True</Option>
-          <Option name="pix_epilog_script"></Option>
+          <Option name="pix_epilog_script"/>
           <Option name="pix_floodguard">False</Option>
           <Option name="pix_fragguard">True</Option>
           <Option name="pix_generate_out_acl">False</Option>
@@ -2475,9 +2514,9 @@
           <Option name="pix_nodnsalias_outbound">True</Option>
           <Option name="pix_ntp1">192.168.1.20</Option>
           <Option name="pix_ntp1_pref">True</Option>
-          <Option name="pix_ntp2"></Option>
+          <Option name="pix_ntp2"/>
           <Option name="pix_ntp2_pref">False</Option>
-          <Option name="pix_ntp3"></Option>
+          <Option name="pix_ntp3"/>
           <Option name="pix_ntp3_pref">False</Option>
           <Option name="pix_optimize_default_nat">True</Option>
           <Option name="pix_prolog_script">	
@@ -2546,8 +2585,8 @@
           <Option name="rpc_ss">0</Option>
           <Option name="rsh_fixup">0 514 0 nil 0</Option>
           <Option name="rtsp_fixup">0 554 0 nil 0</Option>
-          <Option name="scpArgs"></Option>
-          <Option name="script_env_path"></Option>
+          <Option name="scpArgs"/>
+          <Option name="script_env_path"/>
           <Option name="short_script">False</Option>
           <Option name="sip_fixup">0 5060 5060 nil 0</Option>
           <Option name="sip_hh">0</Option>
@@ -2559,11 +2598,11 @@
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">0 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">0 25 25 nil 0</Option>
-          <Option name="snmp_contact"></Option>
-          <Option name="snmp_description"></Option>
-          <Option name="snmp_location"></Option>
+          <Option name="snmp_contact"/>
+          <Option name="snmp_description"/>
+          <Option name="snmp_location"/>
           <Option name="sqlnet_fixup">0 1521 1521 nil 0</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
@@ -2603,6 +2642,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3AFADC09" disabled="False" position="1" action="Translate" comment="">
@@ -2624,6 +2666,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id579976X27842" disabled="True" group="" position="2" action="Translate" comment="">
@@ -2646,6 +2691,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id572656X27842" disabled="True" group="" position="3" action="Translate" comment="">
@@ -2668,6 +2716,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id580015X27842" disabled="False" group="" position="4" action="Translate" comment="">
@@ -2691,6 +2742,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3B1328FB" disabled="False" position="5" action="Translate" comment="">
@@ -2713,6 +2767,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -2968,10 +3025,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
+              <Option name="action_on_reject"/>
               <Option name="limit_suffix">/minute</Option>
               <Option name="limit_value">10</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
@@ -3166,17 +3223,17 @@
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"></Option>
-          <Option name="compiler"></Option>
+          <Option name="cmdline"/>
+          <Option name="compiler"/>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="firewall_dir"></Option>
+          <Option name="firewall_dir"/>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"></Option>
-          <Option name="inst_script"></Option>
-          <Option name="install_script"></Option>
+          <Option name="inst_cmdline"/>
+          <Option name="inst_script"/>
+          <Option name="install_script"/>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">0</Option>
@@ -3188,7 +3245,7 @@
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"></Option>
+          <Option name="log_prefix"/>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
@@ -3213,7 +3270,7 @@
           <Option name="pix_disable_snmp_agent">True</Option>
           <Option name="pix_emulate_out_acl">True</Option>
           <Option name="pix_enable_snmp_traps">False</Option>
-          <Option name="pix_epilog_script"></Option>
+          <Option name="pix_epilog_script"/>
           <Option name="pix_fragguard">False</Option>
           <Option name="pix_h323_abs">True</Option>
           <Option name="pix_h323_hh">0</Option>
@@ -3224,14 +3281,14 @@
           <Option name="pix_ip_address">False</Option>
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
-          <Option name="pix_ntp1"></Option>
+          <Option name="pix_ntp1"/>
           <Option name="pix_ntp1_pref">True</Option>
-          <Option name="pix_ntp2"></Option>
+          <Option name="pix_ntp2"/>
           <Option name="pix_ntp2_pref">False</Option>
-          <Option name="pix_ntp3"></Option>
+          <Option name="pix_ntp3"/>
           <Option name="pix_ntp3_pref">False</Option>
           <Option name="pix_optimize_default_nat">False</Option>
-          <Option name="pix_prolog_script"></Option>
+          <Option name="pix_prolog_script"/>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">False</Option>
           <Option name="pix_rpc_abs">True</Option>
@@ -3254,12 +3311,12 @@
           <Option name="pix_sip_ss">0</Option>
           <Option name="pix_snmp_poll_traps_1">1</Option>
           <Option name="pix_snmp_poll_traps_2">1</Option>
-          <Option name="pix_snmp_server1"></Option>
-          <Option name="pix_snmp_server2"></Option>
+          <Option name="pix_snmp_server1"/>
+          <Option name="pix_snmp_server2"/>
           <Option name="pix_ssh_timeout">5</Option>
-          <Option name="pix_syslog_facility"></Option>
-          <Option name="pix_syslog_host"></Option>
-          <Option name="pix_syslog_level"></Option>
+          <Option name="pix_syslog_facility"/>
+          <Option name="pix_syslog_host"/>
+          <Option name="pix_syslog_level"/>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_tcpmss">False</Option>
           <Option name="pix_tcpmss_value">0</Option>
@@ -3286,10 +3343,10 @@
           <Option name="pix_xlate_ss">0</Option>
           <Option name="platform">iptables</Option>
           <Option name="proxy_arp">False</Option>
-          <Option name="script_env_path"></Option>
-          <Option name="snmp_contact"></Option>
-          <Option name="snmp_description"></Option>
-          <Option name="snmp_location"></Option>
+          <Option name="script_env_path"/>
+          <Option name="snmp_contact"/>
+          <Option name="snmp_description"/>
+          <Option name="snmp_location"/>
           <Option name="use_ip_tool">False</Option>
           <Option name="use_numeric_log_levels">False</Option>
         </FirewallOptions>
@@ -3315,6 +3372,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3DB0F924" disabled="False" position="1" action="Translate" comment="">
@@ -3337,6 +3397,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3DB0F932" disabled="False" position="2" action="Translate" comment="">
@@ -3358,6 +3421,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3DB0F940" disabled="False" position="3" action="Translate" comment="">
@@ -3379,6 +3445,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3DB0F94E" disabled="False" position="4" action="Translate" comment="">
@@ -3400,6 +3469,9 @@
             <TSrv neg="False">
               <ServiceRef ref="tcp-SMTP"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3DB0F95C" disabled="False" position="5" action="Translate" comment="policy NAT&#10;rule">
@@ -3422,6 +3494,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3F9353DD" disabled="False" position="6" action="Translate" comment="policy NAT&#10;rule">
@@ -3444,6 +3519,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3DB0F96A" disabled="False" position="7" action="Translate" comment="">
@@ -3466,6 +3544,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3DB0F978" disabled="False" position="8" action="Translate" comment="">
@@ -3488,6 +3569,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3DB0F986" disabled="False" position="9" action="Translate" comment="">
@@ -3510,6 +3594,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3DB0F994" disabled="False" position="10" action="Translate" comment="">
@@ -3532,6 +3619,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id44AABABD7936" disabled="False" position="11" action="Translate" comment="">
@@ -3553,6 +3643,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3DB0F9A2" disabled="True" position="12" action="Translate" comment="">
@@ -3574,6 +3667,9 @@
             <TSrv neg="False">
               <ServiceRef ref="id3B4FF09A"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -3739,10 +3835,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3DB0F9DB" disabled="False" log="True" position="9" action="Accept" direction="Both" comment="">
@@ -3763,10 +3859,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
+              <Option name="action_on_reject"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"></Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_limit_suffix"/>
+              <Option name="log_prefix"/>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
@@ -3809,10 +3905,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3DB10695" disabled="False" log="False" position="12" action="Accept" direction="Both" comment="">
@@ -3869,10 +3965,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3DB0FA07" disabled="False" log="False" position="15" action="Accept" direction="Both" comment="">
@@ -3893,10 +3989,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3DB0FA12" disabled="False" log="False" position="16" action="Accept" direction="Both" comment="">
@@ -3917,10 +4013,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3DB0FA1D" disabled="True" log="False" position="17" action="Accept" direction="Both" comment="rules 8 and 9 can be&#10;used to test shading">
@@ -3940,10 +4036,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3DB0FA27" disabled="True" log="False" position="18" action="Accept" direction="Both" comment="">
@@ -3963,10 +4059,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3DB0FA31" disabled="False" log="False" position="19" action="Accept" direction="Both" comment="">
@@ -4024,10 +4120,10 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3DB0FA51" disabled="False" log="True" position="22" action="Deny" direction="Both" comment="">
@@ -4047,11 +4143,11 @@
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"></Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_limit_suffix"/>
+              <Option name="log_prefix"/>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
@@ -4084,13 +4180,13 @@
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="cmdline">-v</Option>
-          <Option name="compiler"></Option>
+          <Option name="compiler"/>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="firewall_dir"></Option>
+          <Option name="firewall_dir"/>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ftp_fixup">0 21 21 strict 0</Option>
@@ -4103,9 +4199,9 @@
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">0 389 389 nil 0</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"></Option>
-          <Option name="inst_script"></Option>
-          <Option name="install_script"></Option>
+          <Option name="inst_cmdline"/>
+          <Option name="inst_script"/>
+          <Option name="install_script"/>
           <Option name="limit_suffix">/second</Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">0</Option>
@@ -4117,7 +4213,7 @@
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"></Option>
+          <Option name="log_prefix"/>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
@@ -4145,7 +4241,7 @@
           <Option name="pix_connection_timewait">True</Option>
           <Option name="pix_emulate_out_acl">True</Option>
           <Option name="pix_enable_snmp_traps">True</Option>
-          <Option name="pix_epilog_script"></Option>
+          <Option name="pix_epilog_script"/>
           <Option name="pix_fragguard">True</Option>
           <Option name="pix_h323_abs">True</Option>
           <Option name="pix_h323_hh">0</Option>
@@ -4158,8 +4254,8 @@
           <Option name="pix_nodnsalias_inbound">True</Option>
           <Option name="pix_nodnsalias_outbound">True</Option>
           <Option name="pix_ntp1">192.168.1.20</Option>
-          <Option name="pix_ntp2"></Option>
-          <Option name="pix_ntp3"></Option>
+          <Option name="pix_ntp2"/>
+          <Option name="pix_ntp3"/>
           <Option name="pix_optimize_default_nat">False</Option>
           <Option name="pix_prolog_script">	
 </Option>
@@ -4224,7 +4320,7 @@
           <Option name="rpc_ss">0</Option>
           <Option name="rsh_fixup">0 514 514 nil 0</Option>
           <Option name="rtsp_fixup">0 554 554 nil 0</Option>
-          <Option name="script_env_path"></Option>
+          <Option name="script_env_path"/>
           <Option name="sip_fixup">0 5060 5060 nil 0</Option>
           <Option name="sip_hh">0</Option>
           <Option name="sip_media_hh">0</Option>
@@ -4234,9 +4330,9 @@
           <Option name="sip_ss">0</Option>
           <Option name="skinny_fixup">0 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">0 25 25 nil 0</Option>
-          <Option name="snmp_contact"></Option>
-          <Option name="snmp_description"></Option>
-          <Option name="snmp_location"></Option>
+          <Option name="snmp_contact"/>
+          <Option name="snmp_description"/>
+          <Option name="snmp_location"/>
           <Option name="sqlnet_fixup">0 1521 1521 nil 0</Option>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
@@ -4275,6 +4371,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3DF4596F" disabled="False" position="1" action="Translate" comment="">
@@ -4297,6 +4396,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3DF459C9" disabled="False" position="2" action="Translate" comment="">
@@ -4319,6 +4421,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id41437FB9" disabled="False" position="3" action="Translate" comment="">
@@ -4340,6 +4445,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id4143ADCA" disabled="True" position="4" action="Translate" comment="">
@@ -4361,6 +4469,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id4143CCAB" disabled="True" position="5" action="Translate" comment="">
@@ -4382,6 +4493,9 @@
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -4505,11 +4619,11 @@
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
         <FirewallOptions>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="check_shading">True</Option>
-          <Option name="cmdline"></Option>
-          <Option name="compiler"></Option>
+          <Option name="cmdline"/>
+          <Option name="compiler"/>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -4534,7 +4648,7 @@
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">2 389 389 nil 0</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"></Option>
+          <Option name="mgmt_addr"/>
           <Option name="mgmt_ssh">False</Option>
           <Option name="pix_acl_no_clear">True</Option>
           <Option name="pix_add_clear_statements">False</Option>
@@ -4553,7 +4667,7 @@
           <Option name="pix_emb_limit">0</Option>
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"></Option>
+          <Option name="pix_epilog_script"/>
           <Option name="pix_floodguard">True</Option>
           <Option name="pix_fragguard">True</Option>
           <Option name="pix_h323_abs">True</Option>
@@ -4603,8 +4717,8 @@ no sysopt nodnsalias outbound
           <Option name="pix_sip_mm">30</Option>
           <Option name="pix_sip_ss">0</Option>
           <Option name="pix_ssh_timeout">5</Option>
-          <Option name="pix_syslog_facility"></Option>
-          <Option name="pix_syslog_host"></Option>
+          <Option name="pix_syslog_facility"/>
+          <Option name="pix_syslog_host"/>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">5</Option>
           <Option name="pix_uauth_abs">True</Option>
@@ -4639,9 +4753,9 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">2 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
-          <Option name="snmp_contact"></Option>
-          <Option name="snmp_description"></Option>
-          <Option name="snmp_location"></Option>
+          <Option name="snmp_contact"/>
+          <Option name="snmp_description"/>
+          <Option name="snmp_location"/>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
@@ -4680,6 +4794,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3F8F95A0" disabled="False" position="1" action="Translate" comment="">
@@ -4701,6 +4818,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -4867,8 +4987,8 @@ no sysopt nodnsalias outbound
         </Management>
         <FirewallOptions>
           <Option name="check_shading">False</Option>
-          <Option name="cmdline"></Option>
-          <Option name="compiler"></Option>
+          <Option name="cmdline"/>
+          <Option name="compiler"/>
           <Option name="conn_hh">0</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -4907,7 +5027,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emblem_log_format">True</Option>
           <Option name="pix_emulate_out_acl">True</Option>
           <Option name="pix_enable_snmp_traps">True</Option>
-          <Option name="pix_epilog_script"></Option>
+          <Option name="pix_epilog_script"/>
           <Option name="pix_floodguard">False</Option>
           <Option name="pix_fragguard">True</Option>
           <Option name="pix_h323_abs">True</Option>
@@ -4918,18 +5038,18 @@ no sysopt nodnsalias outbound
           <Option name="pix_include_comments">True</Option>
           <Option name="pix_ip_address">True</Option>
           <Option name="pix_logging_buffered">False</Option>
-          <Option name="pix_logging_buffered_level"></Option>
+          <Option name="pix_logging_buffered_level"/>
           <Option name="pix_logging_console">False</Option>
-          <Option name="pix_logging_console_level"></Option>
+          <Option name="pix_logging_console_level"/>
           <Option name="pix_logging_timestamp">False</Option>
-          <Option name="pix_logging_trap_level"></Option>
+          <Option name="pix_logging_trap_level"/>
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
           <Option name="pix_ntp1">10.3.14.30</Option>
-          <Option name="pix_ntp2"></Option>
-          <Option name="pix_ntp3"></Option>
+          <Option name="pix_ntp2"/>
+          <Option name="pix_ntp3"/>
           <Option name="pix_optimize_default_nat">False</Option>
-          <Option name="pix_prolog_script"></Option>
+          <Option name="pix_prolog_script"/>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">False</Option>
           <Option name="pix_resetinbound">False</Option>
@@ -4956,7 +5076,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_snmp_poll_traps_1">1</Option>
           <Option name="pix_snmp_poll_traps_2">1</Option>
           <Option name="pix_snmp_server1">10.3.14.40</Option>
-          <Option name="pix_snmp_server2"></Option>
+          <Option name="pix_snmp_server2"/>
           <Option name="pix_ssh_timeout">5</Option>
           <Option name="pix_syslog_device_id_opt">string</Option>
           <Option name="pix_syslog_device_id_val">real_firewall</Option>
@@ -4999,10 +5119,10 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">2 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
-          <Option name="snmp_contact"></Option>
+          <Option name="snmp_contact"/>
           <Option name="snmp_description">Cisco PIX Firewall Version 6.2(2)
 </Option>
-          <Option name="snmp_location"></Option>
+          <Option name="snmp_location"/>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
           <Option name="uauth_abs">True</Option>
@@ -5039,6 +5159,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3FA34CB5" disabled="False" position="1" action="Translate" comment="">
@@ -5060,6 +5183,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3FA35114" disabled="False" position="2" action="Translate" comment="">
@@ -5081,6 +5207,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3FA35144" disabled="False" position="3" action="Translate" comment="">
@@ -5102,6 +5231,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3FA4BFD1" disabled="False" position="4" action="Translate" comment="">
@@ -5124,6 +5256,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3FA35071" disabled="False" position="5" action="Translate" comment="">
@@ -5145,6 +5280,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3FA35063" disabled="False" position="6" action="Translate" comment="">
@@ -5166,6 +5304,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3FA44ABB" disabled="False" position="7" action="Translate" comment="">
@@ -5189,6 +5330,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -5252,8 +5396,8 @@ no sysopt nodnsalias outbound
         </Management>
         <FirewallOptions>
           <Option name="check_shading">True</Option>
-          <Option name="cmdline"></Option>
-          <Option name="compiler"></Option>
+          <Option name="cmdline"/>
+          <Option name="compiler"/>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -5279,7 +5423,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_conn_ss">0</Option>
           <Option name="pix_connection_timewait">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"></Option>
+          <Option name="pix_epilog_script"/>
           <Option name="pix_floodguard">True</Option>
           <Option name="pix_fragguard">True</Option>
           <Option name="pix_h323_abs">True</Option>
@@ -5290,11 +5434,11 @@ no sysopt nodnsalias outbound
           <Option name="pix_include_comments">True</Option>
           <Option name="pix_ip_address">False</Option>
           <Option name="pix_logging_buffered">False</Option>
-          <Option name="pix_logging_buffered_level"></Option>
+          <Option name="pix_logging_buffered_level"/>
           <Option name="pix_logging_console">False</Option>
-          <Option name="pix_logging_console_level"></Option>
+          <Option name="pix_logging_console_level"/>
           <Option name="pix_logging_timestamp">False</Option>
-          <Option name="pix_logging_trap_level"></Option>
+          <Option name="pix_logging_trap_level"/>
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
           <Option name="pix_optimize_default_nat">True</Option>
@@ -5328,8 +5472,8 @@ no sysopt nodnsalias outbound
           <Option name="pix_sip_mm">30</Option>
           <Option name="pix_sip_ss">0</Option>
           <Option name="pix_ssh_timeout">5</Option>
-          <Option name="pix_syslog_facility"></Option>
-          <Option name="pix_syslog_host"></Option>
+          <Option name="pix_syslog_facility"/>
+          <Option name="pix_syslog_host"/>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">5</Option>
           <Option name="pix_uauth_abs">True</Option>
@@ -5357,9 +5501,9 @@ no sysopt nodnsalias outbound
           <Option name="sip_media_ss">0</Option>
           <Option name="sip_mm">30</Option>
           <Option name="sip_ss">0</Option>
-          <Option name="snmp_contact"></Option>
-          <Option name="snmp_description"></Option>
-          <Option name="snmp_location"></Option>
+          <Option name="snmp_contact"/>
+          <Option name="snmp_description"/>
+          <Option name="snmp_location"/>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="uauth_abs">True</Option>
@@ -5396,6 +5540,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3FA74FCE" disabled="False" position="1" action="Translate" comment="">
@@ -5417,6 +5564,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3FA7502F" disabled="False" position="2" action="Translate" comment="">
@@ -5438,6 +5588,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -5501,8 +5654,8 @@ no sysopt nodnsalias outbound
         </Management>
         <FirewallOptions>
           <Option name="check_shading">True</Option>
-          <Option name="cmdline"></Option>
-          <Option name="compiler"></Option>
+          <Option name="cmdline"/>
+          <Option name="compiler"/>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -5528,7 +5681,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_conn_ss">0</Option>
           <Option name="pix_connection_timewait">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"></Option>
+          <Option name="pix_epilog_script"/>
           <Option name="pix_floodguard">True</Option>
           <Option name="pix_fragguard">True</Option>
           <Option name="pix_h323_abs">True</Option>
@@ -5539,15 +5692,15 @@ no sysopt nodnsalias outbound
           <Option name="pix_include_comments">True</Option>
           <Option name="pix_ip_address">False</Option>
           <Option name="pix_logging_buffered">False</Option>
-          <Option name="pix_logging_buffered_level"></Option>
+          <Option name="pix_logging_buffered_level"/>
           <Option name="pix_logging_console">False</Option>
-          <Option name="pix_logging_console_level"></Option>
+          <Option name="pix_logging_console_level"/>
           <Option name="pix_logging_timestamp">False</Option>
-          <Option name="pix_logging_trap_level"></Option>
+          <Option name="pix_logging_trap_level"/>
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
           <Option name="pix_optimize_default_nat">True</Option>
-          <Option name="pix_prolog_script"></Option>
+          <Option name="pix_prolog_script"/>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">False</Option>
           <Option name="pix_resetinbound">False</Option>
@@ -5570,8 +5723,8 @@ no sysopt nodnsalias outbound
           <Option name="pix_sip_mm">30</Option>
           <Option name="pix_sip_ss">0</Option>
           <Option name="pix_ssh_timeout">5</Option>
-          <Option name="pix_syslog_facility"></Option>
-          <Option name="pix_syslog_host"></Option>
+          <Option name="pix_syslog_facility"/>
+          <Option name="pix_syslog_host"/>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">5</Option>
           <Option name="pix_uauth_abs">True</Option>
@@ -5599,9 +5752,9 @@ no sysopt nodnsalias outbound
           <Option name="sip_media_ss">0</Option>
           <Option name="sip_mm">30</Option>
           <Option name="sip_ss">0</Option>
-          <Option name="snmp_contact"></Option>
-          <Option name="snmp_description"></Option>
-          <Option name="snmp_location"></Option>
+          <Option name="snmp_contact"/>
+          <Option name="snmp_description"/>
+          <Option name="snmp_location"/>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="uauth_abs">True</Option>
@@ -5638,6 +5791,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3D1BFA8A" disabled="False" position="1" action="Translate" comment="">
@@ -5659,6 +5815,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3AFB66C8" disabled="False" position="2" action="Translate" comment="">
@@ -5680,8 +5839,11 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions>
-              <Option name="id"></Option>
+              <Option name="id"/>
             </NATRuleOptions>
           </NATRule>
           <NATRule id="id3D1BF5EB" disabled="False" position="3" action="Translate" comment="">
@@ -5704,6 +5866,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3D1BF601" disabled="False" position="4" action="Translate" comment="">
@@ -5725,6 +5890,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3D1C2292" disabled="False" position="5" action="Translate" comment="">
@@ -5746,6 +5914,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3D1C16F8" disabled="False" position="6" action="Translate" comment="">
@@ -5767,8 +5938,11 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions>
-              <Option name="id"></Option>
+              <Option name="id"/>
             </NATRuleOptions>
           </NATRule>
           <NATRule id="id3D1BF934" disabled="False" position="7" action="Translate" comment="">
@@ -5790,8 +5964,11 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions>
-              <Option name="id"></Option>
+              <Option name="id"/>
             </NATRuleOptions>
           </NATRule>
           <NATRule id="id3AFB66D6" disabled="False" position="8" action="Translate" comment="">
@@ -5813,8 +5990,11 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions>
-              <Option name="id"></Option>
+              <Option name="id"/>
             </NATRuleOptions>
           </NATRule>
           <NATRule id="id3D1BFB42" disabled="False" position="9" action="Translate" comment="">
@@ -5836,6 +6016,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3D1BF852" disabled="False" position="10" action="Translate" comment="">
@@ -5857,6 +6040,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3D1BFD9A" disabled="False" position="11" action="Translate" comment="">
@@ -5878,6 +6064,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3D1C1104" disabled="False" position="12" action="Translate" comment="">
@@ -5899,6 +6088,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3D1C1D30" disabled="False" position="13" action="Translate" comment="">
@@ -5920,6 +6112,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3D1C1D40" disabled="False" position="14" action="Translate" comment="">
@@ -5941,6 +6136,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id247124X73662" disabled="True" group="" position="15" action="Translate" comment="">
@@ -5965,6 +6163,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3D1BFFA4" disabled="False" position="16" action="Translate" comment="">
@@ -5986,6 +6187,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3D1C0835" disabled="False" position="17" action="Translate" comment="">
@@ -6007,6 +6211,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id16986X27842" disabled="False" group="" position="18" action="Translate" comment="">
@@ -6028,6 +6235,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id414351C7" disabled="False" position="19" action="Translate" comment="">
@@ -6049,6 +6259,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id414351D7" disabled="False" position="20" action="Translate" comment="">
@@ -6070,6 +6283,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3AFB69BD" disabled="False" position="21" action="Translate" comment="">
@@ -6091,6 +6307,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3D1BFFCE" disabled="False" position="22" action="Translate" comment="">
@@ -6112,6 +6331,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3D1BFFE2" disabled="True" position="23" action="Translate" comment="">
@@ -6133,6 +6355,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3D1BFFF6" disabled="False" position="24" action="Translate" comment="">
@@ -6154,6 +6379,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3BEEF6D2" disabled="False" position="25" action="Translate" comment="">
@@ -6175,6 +6403,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3AFB69F7" disabled="True" position="26" action="Translate" comment="">
@@ -6196,6 +6427,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="id3B20468D"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3B7313C4" disabled="False" position="27" action="Translate" comment="">
@@ -6217,6 +6451,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="id3B5009F7"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id47B6CF3421818" disabled="False" position="28" action="Translate" comment="">
@@ -6238,6 +6475,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="id3B5009F7"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id47B6CF4921818" disabled="False" position="29" action="Translate" comment="">
@@ -6259,6 +6499,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="id3B5009F7"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3D1C0B6A" disabled="True" position="30" action="Translate" comment="">
@@ -6280,6 +6523,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -6300,8 +6546,8 @@ no sysopt nodnsalias outbound
               <ObjectRef ref="id3AFB6706"/>
             </Itf>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
               <Option name="log_prefix">Iface: %I RULE %N -- %A **</Option>
               <Option name="stateless">True</Option>
@@ -6322,8 +6568,8 @@ no sysopt nodnsalias outbound
               <ObjectRef ref="id3AFB6706"/>
             </Itf>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
               <Option name="log_prefix">Iface: %I RULE %N -- %A **</Option>
               <Option name="stateless">True</Option>
@@ -6454,17 +6700,17 @@ no sysopt nodnsalias outbound
           <Option name="action_on_reject">ICMP net unreachable</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="cmdline">-v</Option>
-          <Option name="compiler"></Option>
+          <Option name="compiler"/>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="firewall_dir"></Option>
+          <Option name="firewall_dir"/>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
-          <Option name="id"></Option>
+          <Option name="id"/>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"></Option>
-          <Option name="inst_script"></Option>
-          <Option name="install_script"></Option>
+          <Option name="inst_cmdline"/>
+          <Option name="inst_script"/>
+          <Option name="install_script"/>
           <Option name="limit_suffix">/second</Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_accept_redirects">0</Option>
@@ -6503,7 +6749,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_conn_mm">0</Option>
           <Option name="pix_conn_ss">0</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"></Option>
+          <Option name="pix_epilog_script"/>
           <Option name="pix_h323_abs">True</Option>
           <Option name="pix_h323_hh">0</Option>
           <Option name="pix_h323_inact">False</Option>
@@ -6511,7 +6757,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_h323_ss">0</Option>
           <Option name="pix_include_comments">True</Option>
           <Option name="pix_ip_address">False</Option>
-          <Option name="pix_prolog_script"></Option>
+          <Option name="pix_prolog_script"/>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">True</Option>
           <Option name="pix_rpc_abs">True</Option>
@@ -6549,10 +6795,10 @@ no sysopt nodnsalias outbound
           <Option name="pix_xlate_ss">0</Option>
           <Option name="platform">iptables</Option>
           <Option name="proxy_arp">True</Option>
-          <Option name="script_env_path"></Option>
-          <Option name="snmp_contact"></Option>
-          <Option name="snmp_description"></Option>
-          <Option name="snmp_location"></Option>
+          <Option name="script_env_path"/>
+          <Option name="snmp_contact"/>
+          <Option name="snmp_description"/>
+          <Option name="snmp_location"/>
           <Option name="use_ip_tool">True</Option>
           <Option name="use_numeric_log_levels">False</Option>
         </FirewallOptions>
@@ -6861,24 +7107,24 @@ no sysopt nodnsalias outbound
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"></Option>
-          <Option name="compiler"></Option>
+          <Option name="cmdline"/>
+          <Option name="compiler"/>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="firewall_dir"></Option>
+          <Option name="firewall_dir"/>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="h323_hh">0</Option>
           <Option name="h323_mm">5</Option>
           <Option name="h323_ss">0</Option>
-          <Option name="id"></Option>
+          <Option name="id"/>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"></Option>
-          <Option name="inst_script"></Option>
-          <Option name="install_script"></Option>
+          <Option name="inst_cmdline"/>
+          <Option name="inst_script"/>
+          <Option name="install_script"/>
           <Option name="limit_suffix">/second</Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_accept_redirects">0</Option>
@@ -6918,7 +7164,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_conn_ss">0</Option>
           <Option name="pix_connection_timewait">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"></Option>
+          <Option name="pix_epilog_script"/>
           <Option name="pix_fragguard">False</Option>
           <Option name="pix_h323_abs">True</Option>
           <Option name="pix_h323_hh">0</Option>
@@ -6929,7 +7175,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_ip_address">False</Option>
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
-          <Option name="pix_prolog_script"></Option>
+          <Option name="pix_prolog_script"/>
           <Option name="pix_resetinbound">False</Option>
           <Option name="pix_resetoutside">False</Option>
           <Option name="pix_rpc_abs">True</Option>
@@ -6949,9 +7195,9 @@ no sysopt nodnsalias outbound
           <Option name="pix_sip_mm">30</Option>
           <Option name="pix_sip_ss">0</Option>
           <Option name="pix_ssh_timeout">5</Option>
-          <Option name="pix_syslog_facility"></Option>
-          <Option name="pix_syslog_host"></Option>
-          <Option name="pix_syslog_level"></Option>
+          <Option name="pix_syslog_facility"/>
+          <Option name="pix_syslog_host"/>
+          <Option name="pix_syslog_level"/>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">5</Option>
           <Option name="pix_udp_abs">True</Option>
@@ -6974,16 +7220,16 @@ no sysopt nodnsalias outbound
           <Option name="rpc_hh">0</Option>
           <Option name="rpc_mm">10</Option>
           <Option name="rpc_ss">0</Option>
-          <Option name="script_env_path"></Option>
+          <Option name="script_env_path"/>
           <Option name="sip_hh">0</Option>
           <Option name="sip_media_hh">0</Option>
           <Option name="sip_media_mm">0</Option>
           <Option name="sip_media_ss">0</Option>
           <Option name="sip_mm">30</Option>
           <Option name="sip_ss">0</Option>
-          <Option name="snmp_contact"></Option>
-          <Option name="snmp_description"></Option>
-          <Option name="snmp_location"></Option>
+          <Option name="snmp_contact"/>
+          <Option name="snmp_description"/>
+          <Option name="snmp_location"/>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="uauth_abs">True</Option>
@@ -7022,6 +7268,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="tcp-SSH"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3D799F5F" disabled="False" position="1" action="Translate" comment="">
@@ -7043,6 +7292,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="tcp-SSH"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3D79A04C" disabled="False" position="2" action="Translate" comment="">
@@ -7064,6 +7316,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="tcp-SSH"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -7086,7 +7341,7 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"></Option>
+              <Option name="id"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3D79A1C2" disabled="False" log="True" position="1" action="Accept" direction="Both" comment="">
@@ -7107,7 +7362,7 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"></Option>
+              <Option name="id"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3D79A1E4" disabled="False" log="True" position="2" action="Accept" direction="Both" comment="">
@@ -7128,7 +7383,7 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"></Option>
+              <Option name="id"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3B0C63CB" disabled="False" log="False" position="3" action="Accept" direction="Both" comment="'masquerading' rule">
@@ -7148,7 +7403,7 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"></Option>
+              <Option name="id"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id3B0C63D5" disabled="False" log="True" position="4" action="Deny" direction="Both" comment="'catch all' rule">
@@ -7168,7 +7423,7 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"></Option>
+              <Option name="id"/>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
@@ -7203,24 +7458,24 @@ no sysopt nodnsalias outbound
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"></Option>
-          <Option name="compiler"></Option>
+          <Option name="cmdline"/>
+          <Option name="compiler"/>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="firewall_dir"></Option>
+          <Option name="firewall_dir"/>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="h323_hh">0</Option>
           <Option name="h323_mm">5</Option>
           <Option name="h323_ss">0</Option>
-          <Option name="id"></Option>
+          <Option name="id"/>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"></Option>
-          <Option name="inst_script"></Option>
-          <Option name="install_script"></Option>
+          <Option name="inst_cmdline"/>
+          <Option name="inst_script"/>
+          <Option name="install_script"/>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">0</Option>
@@ -7232,7 +7487,7 @@ no sysopt nodnsalias outbound
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"></Option>
+          <Option name="log_prefix"/>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
@@ -7248,36 +7503,36 @@ no sysopt nodnsalias outbound
           <Option name="pix_check_rule_shading">False</Option>
           <Option name="pix_connection_timewait">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"></Option>
+          <Option name="pix_epilog_script"/>
           <Option name="pix_fragguard">False</Option>
           <Option name="pix_include_comments">True</Option>
           <Option name="pix_ip_address">False</Option>
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
-          <Option name="pix_prolog_script"></Option>
+          <Option name="pix_prolog_script"/>
           <Option name="pix_replace_natted_objects">True</Option>
           <Option name="pix_resetinbound">False</Option>
           <Option name="pix_resetoutside">False</Option>
           <Option name="pix_set_host_name">False</Option>
-          <Option name="pix_syslog_facility"></Option>
-          <Option name="pix_syslog_host"></Option>
-          <Option name="pix_syslog_level"></Option>
+          <Option name="pix_syslog_facility"/>
+          <Option name="pix_syslog_host"/>
+          <Option name="pix_syslog_level"/>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="platform">iptables</Option>
           <Option name="proxy_arp">False</Option>
           <Option name="rpc_hh">0</Option>
           <Option name="rpc_mm">10</Option>
           <Option name="rpc_ss">0</Option>
-          <Option name="script_env_path"></Option>
+          <Option name="script_env_path"/>
           <Option name="sip_hh">0</Option>
           <Option name="sip_media_hh">0</Option>
           <Option name="sip_media_mm">0</Option>
           <Option name="sip_media_ss">0</Option>
           <Option name="sip_mm">30</Option>
           <Option name="sip_ss">0</Option>
-          <Option name="snmp_contact"></Option>
-          <Option name="snmp_description"></Option>
-          <Option name="snmp_location"></Option>
+          <Option name="snmp_contact"/>
+          <Option name="snmp_description"/>
+          <Option name="snmp_location"/>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="uauth_abs">True</Option>
@@ -7315,6 +7570,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3DAF6186" disabled="False" position="1" action="Translate" comment="">
@@ -7336,6 +7594,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3D8FFC6C" disabled="False" position="2" action="Translate" comment="">
@@ -7357,6 +7618,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3D8FFC7C" disabled="True" position="3" action="Translate" comment="">
@@ -7378,6 +7642,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -7447,23 +7714,23 @@ no sysopt nodnsalias outbound
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"></Option>
-          <Option name="compiler"></Option>
+          <Option name="cmdline"/>
+          <Option name="compiler"/>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="firewall_dir"></Option>
+          <Option name="firewall_dir"/>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="h323_hh">0</Option>
           <Option name="h323_mm">5</Option>
           <Option name="h323_ss">0</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"></Option>
-          <Option name="inst_script"></Option>
-          <Option name="install_script"></Option>
+          <Option name="inst_cmdline"/>
+          <Option name="inst_script"/>
+          <Option name="install_script"/>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">0</Option>
@@ -7475,7 +7742,7 @@ no sysopt nodnsalias outbound
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"></Option>
+          <Option name="log_prefix"/>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
@@ -7491,7 +7758,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_check_rule_shading">False</Option>
           <Option name="pix_connection_timewait">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"></Option>
+          <Option name="pix_epilog_script"/>
           <Option name="pix_fragguard">False</Option>
           <Option name="pix_include_comments">True</Option>
           <Option name="pix_ip_address">False</Option>
@@ -7503,7 +7770,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_logging_trap_level">4</Option>
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
-          <Option name="pix_prolog_script"></Option>
+          <Option name="pix_prolog_script"/>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">True</Option>
           <Option name="pix_resetinbound">False</Option>
@@ -7519,16 +7786,16 @@ no sysopt nodnsalias outbound
           <Option name="rpc_hh">0</Option>
           <Option name="rpc_mm">10</Option>
           <Option name="rpc_ss">0</Option>
-          <Option name="script_env_path"></Option>
+          <Option name="script_env_path"/>
           <Option name="sip_hh">0</Option>
           <Option name="sip_media_hh">0</Option>
           <Option name="sip_media_mm">0</Option>
           <Option name="sip_media_ss">0</Option>
           <Option name="sip_mm">30</Option>
           <Option name="sip_ss">0</Option>
-          <Option name="snmp_contact"></Option>
-          <Option name="snmp_description"></Option>
-          <Option name="snmp_location"></Option>
+          <Option name="snmp_contact"/>
+          <Option name="snmp_description"/>
+          <Option name="snmp_location"/>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="uauth_abs">True</Option>
@@ -7567,6 +7834,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3DAD0E72" disabled="False" position="1" action="Translate" comment="">
@@ -7588,6 +7858,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -7690,23 +7963,23 @@ no sysopt nodnsalias outbound
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"></Option>
-          <Option name="compiler"></Option>
+          <Option name="cmdline"/>
+          <Option name="compiler"/>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="firewall_dir"></Option>
+          <Option name="firewall_dir"/>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="h323_hh">0</Option>
           <Option name="h323_mm">5</Option>
           <Option name="h323_ss">0</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"></Option>
-          <Option name="inst_script"></Option>
-          <Option name="install_script"></Option>
+          <Option name="inst_cmdline"/>
+          <Option name="inst_script"/>
+          <Option name="install_script"/>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">0</Option>
@@ -7718,7 +7991,7 @@ no sysopt nodnsalias outbound
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"></Option>
+          <Option name="log_prefix"/>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
@@ -7733,10 +8006,10 @@ no sysopt nodnsalias outbound
           <Option name="pix_check_overlapping_statics">True</Option>
           <Option name="pix_check_rule_shading">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"></Option>
+          <Option name="pix_epilog_script"/>
           <Option name="pix_include_comments">True</Option>
           <Option name="pix_ip_address">False</Option>
-          <Option name="pix_prolog_script"></Option>
+          <Option name="pix_prolog_script"/>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">True</Option>
           <Option name="pix_set_host_name">False</Option>
@@ -7745,13 +8018,13 @@ no sysopt nodnsalias outbound
           <Option name="rpc_hh">0</Option>
           <Option name="rpc_mm">10</Option>
           <Option name="rpc_ss">0</Option>
-          <Option name="script_env_path"></Option>
+          <Option name="script_env_path"/>
           <Option name="sip_hh">0</Option>
           <Option name="sip_mm">30</Option>
           <Option name="sip_ss">0</Option>
-          <Option name="snmp_contact"></Option>
-          <Option name="snmp_description"></Option>
-          <Option name="snmp_location"></Option>
+          <Option name="snmp_contact"/>
+          <Option name="snmp_description"/>
+          <Option name="snmp_location"/>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="uauth_abs">True</Option>
@@ -7791,6 +8064,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3D422084" disabled="False" position="1" action="Translate" comment="">
@@ -7812,6 +8088,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3D422099" disabled="False" position="2" action="Translate" comment="">
@@ -7833,6 +8112,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3D436DC2" disabled="False" position="3" action="Translate" comment="">
@@ -7854,6 +8136,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3D420535" disabled="False" position="4" action="Translate" comment="">
@@ -7875,6 +8160,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3D436D6A" disabled="False" position="5" action="Translate" comment="">
@@ -7896,6 +8184,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3D436E2F" disabled="False" position="6" action="Translate" comment="">
@@ -7917,6 +8208,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -8002,8 +8296,8 @@ no sysopt nodnsalias outbound
         </Management>
         <FirewallOptions>
           <Option name="check_shading">False</Option>
-          <Option name="cmdline"></Option>
-          <Option name="compiler"></Option>
+          <Option name="cmdline"/>
+          <Option name="compiler"/>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -8044,7 +8338,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emb_limit">0</Option>
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"></Option>
+          <Option name="pix_epilog_script"/>
           <Option name="pix_floodguard">True</Option>
           <Option name="pix_fragguard">True</Option>
           <Option name="pix_h323_abs">True</Option>
@@ -8055,11 +8349,11 @@ no sysopt nodnsalias outbound
           <Option name="pix_include_comments">True</Option>
           <Option name="pix_ip_address">False</Option>
           <Option name="pix_logging_buffered">False</Option>
-          <Option name="pix_logging_buffered_level"></Option>
+          <Option name="pix_logging_buffered_level"/>
           <Option name="pix_logging_console">False</Option>
-          <Option name="pix_logging_console_level"></Option>
+          <Option name="pix_logging_console_level"/>
           <Option name="pix_logging_timestamp">False</Option>
-          <Option name="pix_logging_trap_level"></Option>
+          <Option name="pix_logging_trap_level"/>
           <Option name="pix_max_conns">0</Option>
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
@@ -8094,8 +8388,8 @@ no sysopt nodnsalias outbound
           <Option name="pix_sip_mm">30</Option>
           <Option name="pix_sip_ss">0</Option>
           <Option name="pix_ssh_timeout">5</Option>
-          <Option name="pix_syslog_facility"></Option>
-          <Option name="pix_syslog_host"></Option>
+          <Option name="pix_syslog_facility"/>
+          <Option name="pix_syslog_host"/>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">5</Option>
           <Option name="pix_uauth_abs">True</Option>
@@ -8130,9 +8424,9 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">2 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
-          <Option name="snmp_contact"></Option>
-          <Option name="snmp_description"></Option>
-          <Option name="snmp_location"></Option>
+          <Option name="snmp_contact"/>
+          <Option name="snmp_description"/>
+          <Option name="snmp_location"/>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
@@ -8179,8 +8473,8 @@ no sysopt nodnsalias outbound
         </Management>
         <FirewallOptions>
           <Option name="check_shading">False</Option>
-          <Option name="cmdline"></Option>
-          <Option name="compiler"></Option>
+          <Option name="cmdline"/>
+          <Option name="compiler"/>
           <Option name="conn_hh">0</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -8216,7 +8510,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_conn_ss">0</Option>
           <Option name="pix_connection_timewait">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"></Option>
+          <Option name="pix_epilog_script"/>
           <Option name="pix_floodguard">False</Option>
           <Option name="pix_fragguard">False</Option>
           <Option name="pix_h323_abs">True</Option>
@@ -8227,11 +8521,11 @@ no sysopt nodnsalias outbound
           <Option name="pix_include_comments">True</Option>
           <Option name="pix_ip_address">False</Option>
           <Option name="pix_logging_buffered">False</Option>
-          <Option name="pix_logging_buffered_level"></Option>
+          <Option name="pix_logging_buffered_level"/>
           <Option name="pix_logging_console">False</Option>
-          <Option name="pix_logging_console_level"></Option>
+          <Option name="pix_logging_console_level"/>
           <Option name="pix_logging_timestamp">False</Option>
-          <Option name="pix_logging_trap_level"></Option>
+          <Option name="pix_logging_trap_level"/>
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
           <Option name="pix_optimize_default_nat">False</Option>
@@ -8265,8 +8559,8 @@ no sysopt nodnsalias outbound
           <Option name="pix_sip_mm">30</Option>
           <Option name="pix_sip_ss">0</Option>
           <Option name="pix_ssh_timeout">5</Option>
-          <Option name="pix_syslog_facility"></Option>
-          <Option name="pix_syslog_host"></Option>
+          <Option name="pix_syslog_facility"/>
+          <Option name="pix_syslog_host"/>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">5</Option>
           <Option name="pix_uauth_abs">True</Option>
@@ -8300,9 +8594,9 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">0 0 0 nil 0</Option>
           <Option name="skinny_fixup">0 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">0 25 25 nil 0</Option>
-          <Option name="snmp_contact"></Option>
-          <Option name="snmp_description"></Option>
-          <Option name="snmp_location"></Option>
+          <Option name="snmp_contact"/>
+          <Option name="snmp_description"/>
+          <Option name="snmp_location"/>
           <Option name="sqlnet_fixup">0 1521 1521 nil 0</Option>
           <Option name="tftp_fixup">0 69 0 nil 0</Option>
           <Option name="uauth_abs">True</Option>
@@ -8487,17 +8781,17 @@ no sysopt nodnsalias outbound
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP host prohibited</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"></Option>
-          <Option name="compiler"></Option>
+          <Option name="cmdline"/>
+          <Option name="compiler"/>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="firewall_dir"></Option>
+          <Option name="firewall_dir"/>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"></Option>
-          <Option name="inst_script"></Option>
-          <Option name="install_script"></Option>
+          <Option name="inst_cmdline"/>
+          <Option name="inst_script"/>
+          <Option name="install_script"/>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">0</Option>
@@ -8507,9 +8801,9 @@ no sysopt nodnsalias outbound
           <Option name="log_all_dropped">False</Option>
           <Option name="log_ip_opt">False</Option>
           <Option name="log_level">debug</Option>
-          <Option name="log_limit_suffix"></Option>
+          <Option name="log_limit_suffix"/>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"></Option>
+          <Option name="log_prefix"/>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">False</Option>
@@ -8518,10 +8812,10 @@ no sysopt nodnsalias outbound
           <Option name="no_optimisation">False</Option>
           <Option name="pass_all_out">False</Option>
           <Option name="platform">iptables</Option>
-          <Option name="script_env_path"></Option>
-          <Option name="snmp_contact"></Option>
-          <Option name="snmp_description"></Option>
-          <Option name="snmp_location"></Option>
+          <Option name="script_env_path"/>
+          <Option name="snmp_contact"/>
+          <Option name="snmp_description"/>
+          <Option name="snmp_location"/>
           <Option name="use_ip_tool">False</Option>
           <Option name="use_numeric_log_levels">False</Option>
         </FirewallOptions>
@@ -8547,6 +8841,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id3F8F93B5" disabled="True" position="1" action="Translate" comment="">
@@ -8568,6 +8865,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -8686,11 +8986,11 @@ no sysopt nodnsalias outbound
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
         <FirewallOptions>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="check_shading">False</Option>
-          <Option name="cmdline"></Option>
-          <Option name="compiler"></Option>
+          <Option name="cmdline"/>
+          <Option name="compiler"/>
           <Option name="conn_hh">0</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -8712,13 +9012,13 @@ no sysopt nodnsalias outbound
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">2 389 389 nil 0</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"></Option>
+          <Option name="mgmt_addr"/>
           <Option name="mgmt_ssh">False</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="pix_acl_basic">True</Option>
           <Option name="pix_acl_no_clear">False</Option>
           <Option name="pix_acl_substitution">False</Option>
-          <Option name="pix_acl_temp_addr"></Option>
+          <Option name="pix_acl_temp_addr"/>
           <Option name="pix_add_clear_statements">False</Option>
           <Option name="pix_assume_fw_part_of_any">False</Option>
           <Option name="pix_check_duplicate_nat">False</Option>
@@ -8737,7 +9037,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emblem_log_format">True</Option>
           <Option name="pix_emulate_out_acl">True</Option>
           <Option name="pix_enable_snmp_traps">True</Option>
-          <Option name="pix_epilog_script"></Option>
+          <Option name="pix_epilog_script"/>
           <Option name="pix_floodguard">False</Option>
           <Option name="pix_fragguard">False</Option>
           <Option name="pix_h323_abs">True</Option>
@@ -8757,10 +9057,10 @@ no sysopt nodnsalias outbound
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
           <Option name="pix_ntp1">10.3.14.30</Option>
-          <Option name="pix_ntp2"></Option>
-          <Option name="pix_ntp3"></Option>
+          <Option name="pix_ntp2"/>
+          <Option name="pix_ntp3"/>
           <Option name="pix_optimize_default_nat">False</Option>
-          <Option name="pix_prolog_script"></Option>
+          <Option name="pix_prolog_script"/>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">True</Option>
           <Option name="pix_resetinbound">False</Option>
@@ -8787,7 +9087,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_snmp_poll_traps_1">1</Option>
           <Option name="pix_snmp_poll_traps_2">1</Option>
           <Option name="pix_snmp_server1">10.3.14.40</Option>
-          <Option name="pix_snmp_server2"></Option>
+          <Option name="pix_snmp_server2"/>
           <Option name="pix_ssh_timeout">5</Option>
           <Option name="pix_syslog_device_id_opt">string</Option>
           <Option name="pix_syslog_device_id_val">real_firewall</Option>
@@ -8831,12 +9131,12 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">2 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
-          <Option name="snmp_contact"></Option>
+          <Option name="snmp_contact"/>
           <Option name="snmp_description">Cisco PIX Firewall Version 6.2(2)
 </Option>
-          <Option name="snmp_location"></Option>
+          <Option name="snmp_location"/>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
           <Option name="uauth_abs">True</Option>
           <Option name="uauth_hh">0</Option>
@@ -8873,6 +9173,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -9119,6 +9422,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id444A04F49567" disabled="False" position="1" action="Translate" comment="">
@@ -9140,6 +9446,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id444A05029567" disabled="False" position="2" action="Translate" comment="">
@@ -9161,6 +9470,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id444A05109567" disabled="False" position="3" action="Translate" comment="">
@@ -9182,6 +9494,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id444A051E9567" disabled="False" position="4" action="Translate" comment="">
@@ -9203,6 +9518,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id444A052C9567" disabled="False" position="5" action="Translate" comment="">
@@ -9224,6 +9542,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="tcp-SMTP"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id444A053A9567" disabled="False" position="6" action="Translate" comment="">
@@ -9245,6 +9566,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id444A05489567" disabled="False" position="7" action="Translate" comment="">
@@ -9266,6 +9590,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id444A05569567" disabled="False" position="8" action="Translate" comment="">
@@ -9291,6 +9618,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id444A05689567" disabled="False" position="9" action="Translate" comment="">
@@ -9312,6 +9642,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id444A05769567" disabled="False" position="10" action="Translate" comment="">
@@ -9333,6 +9666,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id444A05849567" disabled="False" position="11" action="Translate" comment="">
@@ -9354,6 +9690,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id444A05929567" disabled="True" position="12" action="Translate" comment="">
@@ -9375,6 +9714,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="id3B4FF09A"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -9524,10 +9866,10 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
+              <Option name="action_on_reject"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"></Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_limit_suffix"/>
+              <Option name="log_prefix"/>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
@@ -9566,10 +9908,10 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id444A041B9567" disabled="False" log="True" position="10" action="Accept" direction="Both" comment="">
@@ -9590,10 +9932,10 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
+              <Option name="action_on_reject"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"></Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_limit_suffix"/>
+              <Option name="log_prefix"/>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
@@ -9636,10 +9978,10 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id444A04429567" disabled="False" log="False" position="13" action="Accept" direction="Both" comment="">
@@ -9715,10 +10057,10 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id444A04749567" disabled="False" log="False" position="17" action="Accept" direction="Both" comment="">
@@ -9739,10 +10081,10 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id444A04819567" disabled="False" log="False" position="18" action="Accept" direction="Both" comment="">
@@ -9763,10 +10105,10 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id444A048E9567" disabled="False" log="False" position="19" action="Accept" direction="Both" comment="objects hostA and hostB are&#10;redundant and should be removed by&#10; removeRedundantAddressesFromDst">
@@ -9788,10 +10130,10 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id444A049C9567" disabled="False" log="False" position="20" action="Accept" direction="Both" comment="">
@@ -9829,10 +10171,10 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id444A04B49567" disabled="True" log="False" position="22" action="Accept" direction="Both" comment="">
@@ -9852,10 +10194,10 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id444A04C09567" disabled="False" log="True" position="23" action="Accept" direction="Both" comment="">
@@ -9894,10 +10236,10 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id444A04D99567" disabled="False" log="True" position="25" action="Deny" direction="Both" comment="">
@@ -9917,11 +10259,11 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"></Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_limit_suffix"/>
+              <Option name="log_prefix"/>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
@@ -9951,12 +10293,12 @@ no sysopt nodnsalias outbound
           <Option name="accept_established">False</Option>
           <Option name="accept_new_tcp_with_no_syn">False</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="check_shading">True</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="cmdline">-v</Option>
-          <Option name="compiler"></Option>
+          <Option name="compiler"/>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -9965,7 +10307,7 @@ no sysopt nodnsalias outbound
           <Option name="dns_fixup">2 65535 0 nil 0</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
-          <Option name="firewall_dir"></Option>
+          <Option name="firewall_dir"/>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ftp_fixup">0 21 0 strict 0</Option>
@@ -9982,9 +10324,9 @@ no sysopt nodnsalias outbound
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">0 389 389 nil 0</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"></Option>
-          <Option name="inst_script"></Option>
-          <Option name="install_script"></Option>
+          <Option name="inst_cmdline"/>
+          <Option name="inst_script"/>
+          <Option name="install_script"/>
           <Option name="limit_suffix">/second</Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">0</Option>
@@ -9996,12 +10338,12 @@ no sysopt nodnsalias outbound
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"></Option>
+          <Option name="log_prefix"/>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"></Option>
+          <Option name="mgmt_addr"/>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modulate_state">False</Option>
           <Option name="no_iochains_for_any">False</Option>
@@ -10010,7 +10352,7 @@ no sysopt nodnsalias outbound
           <Option name="openbsd_ip_forward">1</Option>
           <Option name="openbsd_ip_redirect">0</Option>
           <Option name="openbsd_ip_sourceroute">0</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="pass_all_out">False</Option>
           <Option name="pix_acl_basic">False</Option>
           <Option name="pix_acl_no_clear">False</Option>
@@ -10034,7 +10376,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
           <Option name="pix_enable_snmp_traps">True</Option>
-          <Option name="pix_epilog_script"></Option>
+          <Option name="pix_epilog_script"/>
           <Option name="pix_floodguard">False</Option>
           <Option name="pix_fragguard">True</Option>
           <Option name="pix_h323_abs">True</Option>
@@ -10055,9 +10397,9 @@ no sysopt nodnsalias outbound
           <Option name="pix_nodnsalias_outbound">True</Option>
           <Option name="pix_ntp1">192.168.1.20</Option>
           <Option name="pix_ntp1_pref">True</Option>
-          <Option name="pix_ntp2"></Option>
+          <Option name="pix_ntp2"/>
           <Option name="pix_ntp2_pref">False</Option>
-          <Option name="pix_ntp3"></Option>
+          <Option name="pix_ntp3"/>
           <Option name="pix_ntp3_pref">False</Option>
           <Option name="pix_optimize_default_nat">True</Option>
           <Option name="pix_prolog_script">	
@@ -10125,7 +10467,7 @@ no sysopt nodnsalias outbound
           <Option name="rpc_ss">0</Option>
           <Option name="rsh_fixup">0 514 0 nil 0</Option>
           <Option name="rtsp_fixup">0 554 0 nil 0</Option>
-          <Option name="script_env_path"></Option>
+          <Option name="script_env_path"/>
           <Option name="sip_fixup">0 5060 5060 nil 0</Option>
           <Option name="sip_hh">0</Option>
           <Option name="sip_media_hh">0</Option>
@@ -10136,11 +10478,11 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">0 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">0 25 25 nil 0</Option>
-          <Option name="snmp_contact"></Option>
-          <Option name="snmp_description"></Option>
-          <Option name="snmp_location"></Option>
+          <Option name="snmp_contact"/>
+          <Option name="snmp_description"/>
+          <Option name="snmp_location"/>
           <Option name="sqlnet_fixup">0 1521 1521 nil 0</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
@@ -10179,6 +10521,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id43876E2618346" disabled="False" position="1" action="Translate" comment="">
@@ -10200,6 +10545,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id43876E5218346" disabled="False" position="2" action="Translate" comment="rule-time&#10;objects are not supported">
@@ -10221,6 +10569,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id43876E6918346" disabled="True" position="3" action="Translate" comment="">
@@ -10243,6 +10594,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id43876E7B18346" disabled="True" position="4" action="Translate" comment="">
@@ -10265,6 +10619,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -10518,50 +10875,50 @@ no sysopt nodnsalias outbound
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="activationCmd"></Option>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="activationCmd"/>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"></Option>
-          <Option name="compiler"></Option>
+          <Option name="cmdline"/>
+          <Option name="compiler"/>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="epilog_script"></Option>
-          <Option name="firewall_dir"></Option>
+          <Option name="epilog_script"/>
+          <Option name="firewall_dir"/>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="inst_cmdline"></Option>
-          <Option name="inst_script"></Option>
-          <Option name="install_script"></Option>
+          <Option name="inst_cmdline"/>
+          <Option name="inst_script"/>
+          <Option name="install_script"/>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"></Option>
-          <Option name="linux24_accept_source_route"></Option>
-          <Option name="linux24_icmp_echo_ignore_all"></Option>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
-          <Option name="linux24_ip_dynaddr"></Option>
-          <Option name="linux24_ip_forward"></Option>
-          <Option name="linux24_log_martians"></Option>
-          <Option name="linux24_path_ip"></Option>
-          <Option name="linux24_path_iptables"></Option>
-          <Option name="linux24_path_logger"></Option>
-          <Option name="linux24_path_lsmod"></Option>
-          <Option name="linux24_path_modprobe"></Option>
-          <Option name="linux24_rp_filter"></Option>
-          <Option name="linux24_tcp_ecn"></Option>
-          <Option name="linux24_tcp_fack"></Option>
+          <Option name="linux24_accept_redirects"/>
+          <Option name="linux24_accept_source_route"/>
+          <Option name="linux24_icmp_echo_ignore_all"/>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
+          <Option name="linux24_ip_dynaddr"/>
+          <Option name="linux24_ip_forward"/>
+          <Option name="linux24_log_martians"/>
+          <Option name="linux24_path_ip"/>
+          <Option name="linux24_path_iptables"/>
+          <Option name="linux24_path_logger"/>
+          <Option name="linux24_path_lsmod"/>
+          <Option name="linux24_path_modprobe"/>
+          <Option name="linux24_rp_filter"/>
+          <Option name="linux24_tcp_ecn"/>
+          <Option name="linux24_tcp_fack"/>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"></Option>
-          <Option name="linux24_tcp_syncookies"></Option>
-          <Option name="linux24_tcp_timestamps"></Option>
-          <Option name="linux24_tcp_window_scaling"></Option>
+          <Option name="linux24_tcp_sack"/>
+          <Option name="linux24_tcp_syncookies"/>
+          <Option name="linux24_tcp_timestamps"/>
+          <Option name="linux24_tcp_window_scaling"/>
           <Option name="load_modules">False</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -10575,20 +10932,20 @@ no sysopt nodnsalias outbound
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="mgmt_addr"></Option>
+          <Option name="mgmt_addr"/>
           <Option name="mgmt_ssh">False</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="platform">iptables</Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"></Option>
+          <Option name="prolog_script"/>
           <Option name="proxy_arp">False</Option>
-          <Option name="script_env_path"></Option>
-          <Option name="snmp_contact"></Option>
-          <Option name="snmp_description"></Option>
-          <Option name="snmp_location"></Option>
-          <Option name="sshArgs"></Option>
+          <Option name="script_env_path"/>
+          <Option name="snmp_contact"/>
+          <Option name="snmp_description"/>
+          <Option name="snmp_location"/>
+          <Option name="sshArgs"/>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -10620,6 +10977,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id43891B6E674" disabled="True" position="1" action="Translate" comment="">
@@ -10641,6 +11001,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -10922,50 +11285,50 @@ no sysopt nodnsalias outbound
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="activationCmd"></Option>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="activationCmd"/>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"></Option>
-          <Option name="compiler"></Option>
+          <Option name="cmdline"/>
+          <Option name="compiler"/>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="epilog_script"></Option>
-          <Option name="firewall_dir"></Option>
+          <Option name="epilog_script"/>
+          <Option name="firewall_dir"/>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="inst_cmdline"></Option>
-          <Option name="inst_script"></Option>
-          <Option name="install_script"></Option>
+          <Option name="inst_cmdline"/>
+          <Option name="inst_script"/>
+          <Option name="install_script"/>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"></Option>
-          <Option name="linux24_accept_source_route"></Option>
-          <Option name="linux24_icmp_echo_ignore_all"></Option>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
-          <Option name="linux24_ip_dynaddr"></Option>
-          <Option name="linux24_ip_forward"></Option>
-          <Option name="linux24_log_martians"></Option>
-          <Option name="linux24_path_ip"></Option>
-          <Option name="linux24_path_iptables"></Option>
-          <Option name="linux24_path_logger"></Option>
-          <Option name="linux24_path_lsmod"></Option>
-          <Option name="linux24_path_modprobe"></Option>
-          <Option name="linux24_rp_filter"></Option>
-          <Option name="linux24_tcp_ecn"></Option>
-          <Option name="linux24_tcp_fack"></Option>
+          <Option name="linux24_accept_redirects"/>
+          <Option name="linux24_accept_source_route"/>
+          <Option name="linux24_icmp_echo_ignore_all"/>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
+          <Option name="linux24_ip_dynaddr"/>
+          <Option name="linux24_ip_forward"/>
+          <Option name="linux24_log_martians"/>
+          <Option name="linux24_path_ip"/>
+          <Option name="linux24_path_iptables"/>
+          <Option name="linux24_path_logger"/>
+          <Option name="linux24_path_lsmod"/>
+          <Option name="linux24_path_modprobe"/>
+          <Option name="linux24_rp_filter"/>
+          <Option name="linux24_tcp_ecn"/>
+          <Option name="linux24_tcp_fack"/>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"></Option>
-          <Option name="linux24_tcp_syncookies"></Option>
-          <Option name="linux24_tcp_timestamps"></Option>
-          <Option name="linux24_tcp_window_scaling"></Option>
+          <Option name="linux24_tcp_sack"/>
+          <Option name="linux24_tcp_syncookies"/>
+          <Option name="linux24_tcp_timestamps"/>
+          <Option name="linux24_tcp_window_scaling"/>
           <Option name="load_modules">False</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -10979,20 +11342,20 @@ no sysopt nodnsalias outbound
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="mgmt_addr"></Option>
+          <Option name="mgmt_addr"/>
           <Option name="mgmt_ssh">False</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="platform">iptables</Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"></Option>
+          <Option name="prolog_script"/>
           <Option name="proxy_arp">False</Option>
-          <Option name="script_env_path"></Option>
-          <Option name="snmp_contact"></Option>
-          <Option name="snmp_description"></Option>
-          <Option name="snmp_location"></Option>
-          <Option name="sshArgs"></Option>
+          <Option name="script_env_path"/>
+          <Option name="snmp_contact"/>
+          <Option name="snmp_description"/>
+          <Option name="snmp_location"/>
+          <Option name="sshArgs"/>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -11024,6 +11387,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id451430BC28543" disabled="False" position="1" action="Translate" comment="">
@@ -11045,6 +11411,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id451430CA28543" disabled="False" position="2" action="Translate" comment="">
@@ -11066,6 +11435,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id451430D828543" disabled="False" position="3" action="Translate" comment="">
@@ -11087,6 +11459,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id451430E628543" disabled="False" position="4" action="Translate" comment="">
@@ -11108,6 +11483,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id451430F428543" disabled="False" position="5" action="Translate" comment="">
@@ -11129,6 +11507,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="tcp-SMTP"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id47B71DF021818" disabled="False" position="6" action="Translate" comment="">
@@ -11150,6 +11531,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="tcp-SMTP"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id47B71E0621818" disabled="False" position="7" action="Translate" comment="">
@@ -11171,6 +11555,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="tcp-SMTP"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id47B71E1B21818" disabled="False" position="8" action="Translate" comment="">
@@ -11192,6 +11579,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="tcp-SMTP"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id4514310228543" disabled="False" position="9" action="Translate" comment="">
@@ -11213,6 +11603,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id4514311028543" disabled="False" position="10" action="Translate" comment="">
@@ -11234,6 +11627,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id4514311E28543" disabled="False" position="11" action="Translate" comment="">
@@ -11259,6 +11655,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id4514313028543" disabled="False" position="12" action="Translate" comment="">
@@ -11280,6 +11679,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id4514313E28543" disabled="False" position="13" action="Translate" comment="">
@@ -11301,6 +11703,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id4514314C28543" disabled="False" position="14" action="Translate" comment="">
@@ -11322,6 +11727,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id4514315A28543" disabled="True" position="15" action="Translate" comment="">
@@ -11343,6 +11751,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="id3B4FF09A"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -11492,10 +11903,10 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
+              <Option name="action_on_reject"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"></Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_limit_suffix"/>
+              <Option name="log_prefix"/>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
@@ -11571,10 +11982,10 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id45142FE328543" disabled="False" log="True" position="12" action="Accept" direction="Both" comment="">
@@ -11595,10 +12006,10 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
+              <Option name="action_on_reject"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"></Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_limit_suffix"/>
+              <Option name="log_prefix"/>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
@@ -11641,10 +12052,10 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4514300A28543" disabled="False" log="False" position="15" action="Accept" direction="Both" comment="">
@@ -11720,10 +12131,10 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4514303C28543" disabled="False" log="False" position="19" action="Accept" direction="Both" comment="">
@@ -11744,10 +12155,10 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4514304928543" disabled="False" log="False" position="20" action="Accept" direction="Both" comment="">
@@ -11768,10 +12179,10 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4514305628543" disabled="False" log="False" position="21" action="Accept" direction="Both" comment="objects hostA and hostB are&#10;redundant and should be removed by&#10; removeRedundantAddressesFromDst">
@@ -11793,10 +12204,10 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4514306428543" disabled="False" log="False" position="22" action="Accept" direction="Both" comment="">
@@ -11836,10 +12247,10 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4514307C28543" disabled="True" log="False" position="24" action="Accept" direction="Both" comment="">
@@ -11859,10 +12270,10 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id4514308828543" disabled="False" log="True" position="25" action="Accept" direction="Both" comment="">
@@ -11919,10 +12330,10 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id16752X44786" disabled="False" group="" log="True" position="28" action="Deny" direction="Both" comment="">
@@ -11963,11 +12374,11 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"></Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_limit_suffix"/>
+              <Option name="log_prefix"/>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
@@ -11997,12 +12408,12 @@ no sysopt nodnsalias outbound
           <Option name="accept_established">False</Option>
           <Option name="accept_new_tcp_with_no_syn">False</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="cmdline">-v</Option>
-          <Option name="compiler"></Option>
+          <Option name="compiler"/>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -12011,7 +12422,7 @@ no sysopt nodnsalias outbound
           <Option name="dns_fixup">2 65535 0 nil 0</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
-          <Option name="firewall_dir"></Option>
+          <Option name="firewall_dir"/>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ftp_fixup">0 21 0 strict 0</Option>
@@ -12028,9 +12439,9 @@ no sysopt nodnsalias outbound
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">0 389 389 nil 0</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"></Option>
-          <Option name="inst_script"></Option>
-          <Option name="install_script"></Option>
+          <Option name="inst_cmdline"/>
+          <Option name="inst_script"/>
+          <Option name="install_script"/>
           <Option name="limit_suffix">/second</Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">0</Option>
@@ -12042,12 +12453,12 @@ no sysopt nodnsalias outbound
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"></Option>
+          <Option name="log_prefix"/>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"></Option>
+          <Option name="mgmt_addr"/>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modulate_state">False</Option>
           <Option name="no_iochains_for_any">False</Option>
@@ -12056,7 +12467,7 @@ no sysopt nodnsalias outbound
           <Option name="openbsd_ip_forward">1</Option>
           <Option name="openbsd_ip_redirect">0</Option>
           <Option name="openbsd_ip_sourceroute">0</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="pass_all_out">False</Option>
           <Option name="pix_acl_basic">False</Option>
           <Option name="pix_acl_no_clear">False</Option>
@@ -12080,7 +12491,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
           <Option name="pix_enable_snmp_traps">True</Option>
-          <Option name="pix_epilog_script"></Option>
+          <Option name="pix_epilog_script"/>
           <Option name="pix_floodguard">False</Option>
           <Option name="pix_fragguard">True</Option>
           <Option name="pix_generate_out_acl">False</Option>
@@ -12102,9 +12513,9 @@ no sysopt nodnsalias outbound
           <Option name="pix_nodnsalias_outbound">True</Option>
           <Option name="pix_ntp1">192.168.1.20</Option>
           <Option name="pix_ntp1_pref">True</Option>
-          <Option name="pix_ntp2"></Option>
+          <Option name="pix_ntp2"/>
           <Option name="pix_ntp2_pref">False</Option>
-          <Option name="pix_ntp3"></Option>
+          <Option name="pix_ntp3"/>
           <Option name="pix_ntp3_pref">False</Option>
           <Option name="pix_optimize_default_nat">True</Option>
           <Option name="pix_prolog_script">	
@@ -12137,8 +12548,8 @@ no sysopt nodnsalias outbound
           <Option name="pix_snmp_server1">192.168.1.20</Option>
           <Option name="pix_snmp_server2">192.168.1.22</Option>
           <Option name="pix_ssh_timeout">5</Option>
-          <Option name="pix_syslog_device_id_opt"></Option>
-          <Option name="pix_syslog_device_id_val"></Option>
+          <Option name="pix_syslog_device_id_opt"/>
+          <Option name="pix_syslog_device_id_val"/>
           <Option name="pix_syslog_facility">16</Option>
           <Option name="pix_syslog_host">192.168.1.30</Option>
           <Option name="pix_syslog_level">error</Option>
@@ -12175,7 +12586,7 @@ no sysopt nodnsalias outbound
           <Option name="rpc_ss">0</Option>
           <Option name="rsh_fixup">0 514 0 nil 0</Option>
           <Option name="rtsp_fixup">0 554 0 nil 0</Option>
-          <Option name="script_env_path"></Option>
+          <Option name="script_env_path"/>
           <Option name="sip_fixup">0 5060 5060 nil 0</Option>
           <Option name="sip_hh">0</Option>
           <Option name="sip_media_hh">0</Option>
@@ -12186,11 +12597,11 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">0 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">0 25 25 nil 0</Option>
-          <Option name="snmp_contact"></Option>
-          <Option name="snmp_description"></Option>
-          <Option name="snmp_location"></Option>
+          <Option name="snmp_contact"/>
+          <Option name="snmp_description"/>
+          <Option name="snmp_location"/>
           <Option name="sqlnet_fixup">0 1521 1521 nil 0</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
@@ -12229,6 +12640,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id4528A54A20039" disabled="False" position="1" action="Translate" comment="">
@@ -12250,6 +12664,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id4528A55820039" disabled="False" position="2" action="Translate" comment="">
@@ -12271,6 +12688,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id4528A56620039" disabled="False" position="3" action="Translate" comment="">
@@ -12292,6 +12712,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id4528A57420039" disabled="False" position="4" action="Translate" comment="">
@@ -12313,6 +12736,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -12513,11 +12939,11 @@ no sysopt nodnsalias outbound
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
         <FirewallOptions>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="check_shading">False</Option>
-          <Option name="cmdline"></Option>
-          <Option name="compiler"></Option>
+          <Option name="cmdline"/>
+          <Option name="compiler"/>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -12542,13 +12968,13 @@ no sysopt nodnsalias outbound
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">2 389 389 nil 0</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"></Option>
+          <Option name="mgmt_addr"/>
           <Option name="mgmt_ssh">False</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="pix_acl_basic">False</Option>
           <Option name="pix_acl_no_clear">True</Option>
           <Option name="pix_acl_substitution">False</Option>
-          <Option name="pix_acl_temp_addr"></Option>
+          <Option name="pix_acl_temp_addr"/>
           <Option name="pix_add_clear_statements">False</Option>
           <Option name="pix_assume_fw_part_of_any">False</Option>
           <Option name="pix_check_duplicate_nat">False</Option>
@@ -12565,7 +12991,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emb_limit">0</Option>
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"></Option>
+          <Option name="pix_epilog_script"/>
           <Option name="pix_floodguard">True</Option>
           <Option name="pix_fragguard">True</Option>
           <Option name="pix_generate_out_acl">False</Option>
@@ -12616,8 +13042,8 @@ no sysopt nodnsalias outbound
           <Option name="pix_sip_mm">30</Option>
           <Option name="pix_sip_ss">0</Option>
           <Option name="pix_ssh_timeout">5</Option>
-          <Option name="pix_syslog_facility"></Option>
-          <Option name="pix_syslog_host"></Option>
+          <Option name="pix_syslog_facility"/>
+          <Option name="pix_syslog_host"/>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">5</Option>
           <Option name="pix_uauth_abs">True</Option>
@@ -12653,11 +13079,11 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">2 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
-          <Option name="snmp_contact"></Option>
-          <Option name="snmp_description"></Option>
-          <Option name="snmp_location"></Option>
+          <Option name="snmp_contact"/>
+          <Option name="snmp_description"/>
+          <Option name="snmp_location"/>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
@@ -12695,6 +13121,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id45293F0320039" disabled="False" position="1" action="Translate" comment="">
@@ -12716,6 +13145,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id45293F1120039" disabled="False" position="2" action="Translate" comment="">
@@ -12737,6 +13169,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id45293F1F20039" disabled="False" position="3" action="Translate" comment="">
@@ -12758,6 +13193,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id45293F2D20039" disabled="False" position="4" action="Translate" comment="">
@@ -12779,6 +13217,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -13251,11 +13692,11 @@ no sysopt nodnsalias outbound
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
         <FirewallOptions>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="check_shading">False</Option>
-          <Option name="cmdline"></Option>
-          <Option name="compiler"></Option>
+          <Option name="cmdline"/>
+          <Option name="compiler"/>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -13280,13 +13721,13 @@ no sysopt nodnsalias outbound
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">2 389 389 nil 0</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"></Option>
+          <Option name="mgmt_addr"/>
           <Option name="mgmt_ssh">False</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="pix_acl_basic">False</Option>
           <Option name="pix_acl_no_clear">True</Option>
           <Option name="pix_acl_substitution">False</Option>
-          <Option name="pix_acl_temp_addr"></Option>
+          <Option name="pix_acl_temp_addr"/>
           <Option name="pix_add_clear_statements">False</Option>
           <Option name="pix_assume_fw_part_of_any">False</Option>
           <Option name="pix_check_duplicate_nat">False</Option>
@@ -13303,7 +13744,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emb_limit">0</Option>
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"></Option>
+          <Option name="pix_epilog_script"/>
           <Option name="pix_floodguard">True</Option>
           <Option name="pix_fragguard">True</Option>
           <Option name="pix_generate_out_acl">False</Option>
@@ -13354,8 +13795,8 @@ no sysopt nodnsalias outbound
           <Option name="pix_sip_mm">30</Option>
           <Option name="pix_sip_ss">0</Option>
           <Option name="pix_ssh_timeout">5</Option>
-          <Option name="pix_syslog_facility"></Option>
-          <Option name="pix_syslog_host"></Option>
+          <Option name="pix_syslog_facility"/>
+          <Option name="pix_syslog_host"/>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">5</Option>
           <Option name="pix_uauth_abs">True</Option>
@@ -13391,11 +13832,11 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">2 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
-          <Option name="snmp_contact"></Option>
-          <Option name="snmp_description"></Option>
-          <Option name="snmp_location"></Option>
+          <Option name="snmp_contact"/>
+          <Option name="snmp_description"/>
+          <Option name="snmp_location"/>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
@@ -13433,6 +13874,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id4529E46316799" disabled="False" position="1" action="Translate" comment="">
@@ -13454,6 +13898,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id4529E47116799" disabled="False" position="2" action="Translate" comment="">
@@ -13475,6 +13922,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id4529E47F16799" disabled="False" position="3" action="Translate" comment="">
@@ -13496,6 +13946,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id4529E48D16799" disabled="False" position="4" action="Translate" comment="">
@@ -13517,6 +13970,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -13989,11 +14445,11 @@ no sysopt nodnsalias outbound
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
         <FirewallOptions>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="check_shading">False</Option>
-          <Option name="cmdline"></Option>
-          <Option name="compiler"></Option>
+          <Option name="cmdline"/>
+          <Option name="compiler"/>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -14018,13 +14474,13 @@ no sysopt nodnsalias outbound
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">2 389 389 nil 0</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"></Option>
+          <Option name="mgmt_addr"/>
           <Option name="mgmt_ssh">False</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="pix_acl_basic">False</Option>
           <Option name="pix_acl_no_clear">True</Option>
           <Option name="pix_acl_substitution">False</Option>
-          <Option name="pix_acl_temp_addr"></Option>
+          <Option name="pix_acl_temp_addr"/>
           <Option name="pix_add_clear_statements">False</Option>
           <Option name="pix_assume_fw_part_of_any">False</Option>
           <Option name="pix_check_duplicate_nat">False</Option>
@@ -14041,7 +14497,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emb_limit">0</Option>
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"></Option>
+          <Option name="pix_epilog_script"/>
           <Option name="pix_floodguard">True</Option>
           <Option name="pix_fragguard">True</Option>
           <Option name="pix_generate_out_acl">True</Option>
@@ -14092,10 +14548,10 @@ no sysopt nodnsalias outbound
           <Option name="pix_sip_mm">30</Option>
           <Option name="pix_sip_ss">0</Option>
           <Option name="pix_ssh_timeout">5</Option>
-          <Option name="pix_syslog_device_id_opt"></Option>
-          <Option name="pix_syslog_device_id_val"></Option>
-          <Option name="pix_syslog_facility"></Option>
-          <Option name="pix_syslog_host"></Option>
+          <Option name="pix_syslog_device_id_opt"/>
+          <Option name="pix_syslog_device_id_val"/>
+          <Option name="pix_syslog_facility"/>
+          <Option name="pix_syslog_host"/>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">5</Option>
           <Option name="pix_uauth_abs">True</Option>
@@ -14131,11 +14587,11 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">2 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
-          <Option name="snmp_contact"></Option>
-          <Option name="snmp_description"></Option>
-          <Option name="snmp_location"></Option>
+          <Option name="snmp_contact"/>
+          <Option name="snmp_description"/>
+          <Option name="snmp_location"/>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
@@ -14173,6 +14629,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id4529FE6E16799" disabled="False" position="1" action="Translate" comment="">
@@ -14194,6 +14653,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id4529FE7C16799" disabled="False" position="2" action="Translate" comment="">
@@ -14215,6 +14677,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id4529FE8A16799" disabled="False" position="3" action="Translate" comment="">
@@ -14236,6 +14701,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id4529FE9816799" disabled="False" position="4" action="Translate" comment="">
@@ -14257,6 +14725,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -14729,11 +15200,11 @@ no sysopt nodnsalias outbound
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
         <FirewallOptions>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="check_shading">False</Option>
-          <Option name="cmdline"></Option>
-          <Option name="compiler"></Option>
+          <Option name="cmdline"/>
+          <Option name="compiler"/>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -14758,13 +15229,13 @@ no sysopt nodnsalias outbound
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">2 389 389 nil 0</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"></Option>
+          <Option name="mgmt_addr"/>
           <Option name="mgmt_ssh">False</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="pix_acl_basic">False</Option>
           <Option name="pix_acl_no_clear">True</Option>
           <Option name="pix_acl_substitution">False</Option>
-          <Option name="pix_acl_temp_addr"></Option>
+          <Option name="pix_acl_temp_addr"/>
           <Option name="pix_add_clear_statements">False</Option>
           <Option name="pix_assume_fw_part_of_any">False</Option>
           <Option name="pix_check_duplicate_nat">False</Option>
@@ -14781,7 +15252,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emb_limit">0</Option>
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"></Option>
+          <Option name="pix_epilog_script"/>
           <Option name="pix_floodguard">True</Option>
           <Option name="pix_fragguard">True</Option>
           <Option name="pix_generate_out_acl">False</Option>
@@ -14832,8 +15303,8 @@ no sysopt nodnsalias outbound
           <Option name="pix_sip_mm">30</Option>
           <Option name="pix_sip_ss">0</Option>
           <Option name="pix_ssh_timeout">5</Option>
-          <Option name="pix_syslog_facility"></Option>
-          <Option name="pix_syslog_host"></Option>
+          <Option name="pix_syslog_facility"/>
+          <Option name="pix_syslog_host"/>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">5</Option>
           <Option name="pix_uauth_abs">True</Option>
@@ -14869,11 +15340,11 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">2 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
-          <Option name="snmp_contact"></Option>
-          <Option name="snmp_description"></Option>
-          <Option name="snmp_location"></Option>
+          <Option name="snmp_contact"/>
+          <Option name="snmp_description"/>
+          <Option name="snmp_location"/>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
@@ -14911,6 +15382,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id47B7C22E21818" disabled="False" position="1" action="Translate" comment="">
@@ -14932,6 +15406,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="tcp-SMTP"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -15099,7 +15576,7 @@ no sysopt nodnsalias outbound
           <Option name="accept_new_tcp_with_no_syn">true</Option>
           <Option name="add_check_state_rule">true</Option>
           <Option name="admUser">vadim</Option>
-          <Option name="altAddress"></Option>
+          <Option name="altAddress"/>
           <Option name="check_shading">False</Option>
           <Option name="configure_interfaces">true</Option>
           <Option name="conn_hh">0</Option>
@@ -15142,7 +15619,7 @@ no sysopt nodnsalias outbound
           <Option name="mgmt_addr">10.3.14.42</Option>
           <Option name="mgmt_ssh">True</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="pass_all_out">false</Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
@@ -15164,7 +15641,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emb_limit">0</Option>
           <Option name="pix_emblem_log_format">True</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"></Option>
+          <Option name="pix_epilog_script"/>
           <Option name="pix_floodguard">True</Option>
           <Option name="pix_fragguard">False</Option>
           <Option name="pix_generate_out_acl">False</Option>
@@ -15172,14 +15649,14 @@ no sysopt nodnsalias outbound
           <Option name="pix_logging_buffered">True</Option>
           <Option name="pix_logging_buffered_level">6</Option>
           <Option name="pix_logging_console">False</Option>
-          <Option name="pix_logging_console_level"></Option>
+          <Option name="pix_logging_console_level"/>
           <Option name="pix_logging_timestamp">True</Option>
-          <Option name="pix_logging_trap_level"></Option>
+          <Option name="pix_logging_trap_level"/>
           <Option name="pix_max_conns">0</Option>
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
           <Option name="pix_optimize_default_nat">False</Option>
-          <Option name="pix_prolog_script"></Option>
+          <Option name="pix_prolog_script"/>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">True</Option>
           <Option name="pix_resetinbound">False</Option>
@@ -15191,9 +15668,9 @@ no sysopt nodnsalias outbound
           <Option name="pix_ssh_timeout">0</Option>
           <Option name="pix_syslog_device_id_opt">hostname</Option>
           <Option name="pix_syslog_device_id_supported">false</Option>
-          <Option name="pix_syslog_device_id_val"></Option>
-          <Option name="pix_syslog_facility"></Option>
-          <Option name="pix_syslog_host"></Option>
+          <Option name="pix_syslog_device_id_val"/>
+          <Option name="pix_syslog_facility"/>
+          <Option name="pix_syslog_host"/>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">0</Option>
           <Option name="pix_use_acl_remarks">True</Option>
@@ -15218,7 +15695,7 @@ no sysopt nodnsalias outbound
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
           <Option name="solaris_ip_forward">1</Option>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
           <Option name="uauth_abs">False</Option>
           <Option name="uauth_hh">0</Option>
@@ -15256,6 +15733,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id17577X54624" disabled="False" position="1" action="Translate" comment="">
@@ -15277,6 +15757,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id17591X54624" disabled="False" position="2" action="Translate" comment="">
@@ -15298,6 +15781,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id17605X54624" disabled="False" position="3" action="Translate" comment="">
@@ -15319,6 +15805,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id17619X54624" disabled="False" position="4" action="Translate" comment="">
@@ -15340,6 +15829,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id17633X54624" disabled="False" position="5" action="Translate" comment="">
@@ -15361,6 +15853,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="tcp-SMTP"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id17647X54624" disabled="False" position="6" action="Translate" comment="">
@@ -15382,6 +15877,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id17661X54624" disabled="False" position="7" action="Translate" comment="">
@@ -15403,6 +15901,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id17675X54624" disabled="False" position="8" action="Translate" comment="">
@@ -15428,6 +15929,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id17693X54624" disabled="False" position="9" action="Translate" comment="">
@@ -15449,6 +15953,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id17707X54624" disabled="False" position="10" action="Translate" comment="">
@@ -15470,6 +15977,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id17721X54624" disabled="False" position="11" action="Translate" comment="">
@@ -15491,6 +16001,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id17735X54624" disabled="True" position="12" action="Translate" comment="">
@@ -15512,6 +16025,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="id3B4FF09A"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -15661,10 +16177,10 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
+              <Option name="action_on_reject"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"></Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_limit_suffix"/>
+              <Option name="log_prefix"/>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
@@ -15703,10 +16219,10 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id17359X54624" disabled="False" log="True" position="10" action="Accept" direction="Both" comment="">
@@ -15727,10 +16243,10 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
+              <Option name="action_on_reject"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"></Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_limit_suffix"/>
+              <Option name="log_prefix"/>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
@@ -15773,10 +16289,10 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id17398X54624" disabled="False" log="False" position="13" action="Accept" direction="Both" comment="">
@@ -15852,10 +16368,10 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id17448X54624" disabled="False" log="False" position="17" action="Accept" direction="Both" comment="">
@@ -15876,10 +16392,10 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id17461X54624" disabled="False" log="False" position="18" action="Accept" direction="Both" comment="">
@@ -15900,10 +16416,10 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id17474X54624" disabled="False" log="False" position="19" action="Accept" direction="Both" comment="objects hostA and hostB are&#10;redundant and should be removed by&#10; removeRedundantAddressesFromDst">
@@ -15925,10 +16441,10 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id17488X54624" disabled="False" log="False" position="20" action="Accept" direction="Both" comment="">
@@ -15966,10 +16482,10 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id17512X54624" disabled="True" log="False" position="22" action="Accept" direction="Both" comment="">
@@ -15989,10 +16505,10 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id17524X54624" disabled="False" log="True" position="23" action="Accept" direction="Both" comment="">
@@ -16031,10 +16547,10 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_prefix"/>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule id="id17549X54624" disabled="False" log="True" position="25" action="Deny" direction="Both" comment="">
@@ -16054,11 +16570,11 @@ no sysopt nodnsalias outbound
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"></Option>
-              <Option name="limit_suffix"></Option>
+              <Option name="action_on_reject"/>
+              <Option name="limit_suffix"/>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"></Option>
-              <Option name="log_prefix"></Option>
+              <Option name="log_limit_suffix"/>
+              <Option name="log_prefix"/>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
@@ -16088,12 +16604,12 @@ no sysopt nodnsalias outbound
           <Option name="accept_established">False</Option>
           <Option name="accept_new_tcp_with_no_syn">False</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="check_shading">True</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="cmdline">-v</Option>
-          <Option name="compiler"></Option>
+          <Option name="compiler"/>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -16102,7 +16618,7 @@ no sysopt nodnsalias outbound
           <Option name="dns_fixup">2 65535 0 nil 0</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
-          <Option name="firewall_dir"></Option>
+          <Option name="firewall_dir"/>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ftp_fixup">0 21 0 strict 0</Option>
@@ -16119,9 +16635,9 @@ no sysopt nodnsalias outbound
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">0 389 389 nil 0</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"></Option>
-          <Option name="inst_script"></Option>
-          <Option name="install_script"></Option>
+          <Option name="inst_cmdline"/>
+          <Option name="inst_script"/>
+          <Option name="install_script"/>
           <Option name="limit_suffix">/second</Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">0</Option>
@@ -16133,12 +16649,12 @@ no sysopt nodnsalias outbound
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"></Option>
+          <Option name="log_prefix"/>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"></Option>
+          <Option name="mgmt_addr"/>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modulate_state">False</Option>
           <Option name="no_iochains_for_any">False</Option>
@@ -16147,7 +16663,7 @@ no sysopt nodnsalias outbound
           <Option name="openbsd_ip_forward">1</Option>
           <Option name="openbsd_ip_redirect">0</Option>
           <Option name="openbsd_ip_sourceroute">0</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="pass_all_out">False</Option>
           <Option name="pix_acl_basic">False</Option>
           <Option name="pix_acl_no_clear">False</Option>
@@ -16171,7 +16687,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
           <Option name="pix_enable_snmp_traps">True</Option>
-          <Option name="pix_epilog_script"></Option>
+          <Option name="pix_epilog_script"/>
           <Option name="pix_floodguard">False</Option>
           <Option name="pix_fragguard">True</Option>
           <Option name="pix_h323_abs">True</Option>
@@ -16192,9 +16708,9 @@ no sysopt nodnsalias outbound
           <Option name="pix_nodnsalias_outbound">True</Option>
           <Option name="pix_ntp1">192.168.1.20</Option>
           <Option name="pix_ntp1_pref">True</Option>
-          <Option name="pix_ntp2"></Option>
+          <Option name="pix_ntp2"/>
           <Option name="pix_ntp2_pref">False</Option>
-          <Option name="pix_ntp3"></Option>
+          <Option name="pix_ntp3"/>
           <Option name="pix_ntp3_pref">False</Option>
           <Option name="pix_optimize_default_nat">True</Option>
           <Option name="pix_prolog_script">	
@@ -16262,7 +16778,7 @@ no sysopt nodnsalias outbound
           <Option name="rpc_ss">0</Option>
           <Option name="rsh_fixup">0 514 0 nil 0</Option>
           <Option name="rtsp_fixup">0 554 0 nil 0</Option>
-          <Option name="script_env_path"></Option>
+          <Option name="script_env_path"/>
           <Option name="sip_fixup">0 5060 5060 nil 0</Option>
           <Option name="sip_hh">0</Option>
           <Option name="sip_media_hh">0</Option>
@@ -16273,11 +16789,11 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">0 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">0 25 25 nil 0</Option>
-          <Option name="snmp_contact"></Option>
-          <Option name="snmp_description"></Option>
-          <Option name="snmp_location"></Option>
+          <Option name="snmp_contact"/>
+          <Option name="snmp_description"/>
+          <Option name="snmp_location"/>
           <Option name="sqlnet_fixup">0 1521 1521 nil 0</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
@@ -16317,6 +16833,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -16564,6 +17083,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -16811,6 +17333,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -17057,6 +17582,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -17334,12 +17862,12 @@ no sysopt nodnsalias outbound
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"></Option>
-          <Option name="compiler"></Option>
+          <Option name="cmdline"/>
+          <Option name="compiler"/>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -17348,8 +17876,8 @@ no sysopt nodnsalias outbound
           <Option name="dns_fixup">2 65535 0 nil 0</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
-          <Option name="filesystem"></Option>
-          <Option name="firewall_dir"></Option>
+          <Option name="filesystem"/>
+          <Option name="firewall_dir"/>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ftp_fixup">2 21 0 strict 0</Option>
@@ -17366,9 +17894,9 @@ no sysopt nodnsalias outbound
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">2 389 389 nil 0</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"></Option>
-          <Option name="inst_script"></Option>
-          <Option name="install_script"></Option>
+          <Option name="inst_cmdline"/>
+          <Option name="inst_script"/>
+          <Option name="install_script"/>
           <Option name="ip_options_eool_fixup">0 0 0 nil 0</Option>
           <Option name="ip_options_nop_fixup">1 0 0 nil 0</Option>
           <Option name="ip_options_rtralt">2 0 0 nil 0</Option>
@@ -17385,22 +17913,22 @@ no sysopt nodnsalias outbound
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"></Option>
+          <Option name="log_prefix"/>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"></Option>
+          <Option name="mgmt_addr"/>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modulate_state">False</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="pass_all_out">False</Option>
           <Option name="pix_acl_basic">True</Option>
           <Option name="pix_acl_no_clear">False</Option>
           <Option name="pix_acl_substitution">False</Option>
-          <Option name="pix_acl_temp_addr"></Option>
+          <Option name="pix_acl_temp_addr"/>
           <Option name="pix_add_clear_statements">True</Option>
           <Option name="pix_assume_fw_part_of_any">True</Option>
           <Option name="pix_check_duplicate_nat">False</Option>
@@ -17412,7 +17940,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emb_limit">0</Option>
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"></Option>
+          <Option name="pix_epilog_script"/>
           <Option name="pix_floodguard">False</Option>
           <Option name="pix_fragguard">False</Option>
           <Option name="pix_generate_out_acl">False</Option>
@@ -17428,7 +17956,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
           <Option name="pix_optimize_default_nat">False</Option>
-          <Option name="pix_prolog_script"></Option>
+          <Option name="pix_prolog_script"/>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">True</Option>
           <Option name="pix_resetinbound">False</Option>
@@ -17436,10 +17964,10 @@ no sysopt nodnsalias outbound
           <Option name="pix_route_dnat">False</Option>
           <Option name="pix_set_host_name">False</Option>
           <Option name="pix_ssh_timeout">0</Option>
-          <Option name="pix_syslog_device_id_opt"></Option>
-          <Option name="pix_syslog_device_id_val"></Option>
-          <Option name="pix_syslog_facility"></Option>
-          <Option name="pix_syslog_host"></Option>
+          <Option name="pix_syslog_device_id_opt"/>
+          <Option name="pix_syslog_device_id_val"/>
+          <Option name="pix_syslog_facility"/>
+          <Option name="pix_syslog_host"/>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">0</Option>
           <Option name="pix_use_acl_remarks">False</Option>
@@ -17452,8 +17980,8 @@ no sysopt nodnsalias outbound
           <Option name="rpc_ss">0</Option>
           <Option name="rsh_fixup">2 514 0 nil 0</Option>
           <Option name="rtsp_fixup">2 554 0 nil 0</Option>
-          <Option name="scpArgs"></Option>
-          <Option name="script_env_path"></Option>
+          <Option name="scpArgs"/>
+          <Option name="script_env_path"/>
           <Option name="short_script">False</Option>
           <Option name="sip_fixup">2 5060 5060 nil 0</Option>
           <Option name="sip_hh">0</Option>
@@ -17465,11 +17993,11 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">2 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
-          <Option name="snmp_contact"></Option>
-          <Option name="snmp_description"></Option>
-          <Option name="snmp_location"></Option>
+          <Option name="snmp_contact"/>
+          <Option name="snmp_description"/>
+          <Option name="snmp_location"/>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
@@ -17510,6 +18038,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -17681,12 +18212,12 @@ no sysopt nodnsalias outbound
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"></Option>
-          <Option name="compiler"></Option>
+          <Option name="cmdline"/>
+          <Option name="compiler"/>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -17695,8 +18226,8 @@ no sysopt nodnsalias outbound
           <Option name="dns_fixup">2 65535 0 nil 0</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
-          <Option name="filesystem"></Option>
-          <Option name="firewall_dir"></Option>
+          <Option name="filesystem"/>
+          <Option name="firewall_dir"/>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ftp_fixup">2 21 0 strict 0</Option>
@@ -17713,9 +18244,9 @@ no sysopt nodnsalias outbound
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">2 389 389 nil 0</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"></Option>
-          <Option name="inst_script"></Option>
-          <Option name="install_script"></Option>
+          <Option name="inst_cmdline"/>
+          <Option name="inst_script"/>
+          <Option name="install_script"/>
           <Option name="ip_options_eool_fixup">0 0 0 nil 0</Option>
           <Option name="ip_options_nop_fixup">1 0 0 nil 0</Option>
           <Option name="ip_options_rtralt">2 0 0 nil 0</Option>
@@ -17732,22 +18263,22 @@ no sysopt nodnsalias outbound
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"></Option>
+          <Option name="log_prefix"/>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"></Option>
+          <Option name="mgmt_addr"/>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modulate_state">False</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="pass_all_out">False</Option>
           <Option name="pix_acl_basic">True</Option>
           <Option name="pix_acl_no_clear">False</Option>
           <Option name="pix_acl_substitution">False</Option>
-          <Option name="pix_acl_temp_addr"></Option>
+          <Option name="pix_acl_temp_addr"/>
           <Option name="pix_add_clear_statements">True</Option>
           <Option name="pix_assume_fw_part_of_any">True</Option>
           <Option name="pix_check_duplicate_nat">False</Option>
@@ -17759,7 +18290,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emb_limit">0</Option>
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"></Option>
+          <Option name="pix_epilog_script"/>
           <Option name="pix_floodguard">False</Option>
           <Option name="pix_fragguard">False</Option>
           <Option name="pix_generate_out_acl">False</Option>
@@ -17775,7 +18306,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
           <Option name="pix_optimize_default_nat">False</Option>
-          <Option name="pix_prolog_script"></Option>
+          <Option name="pix_prolog_script"/>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">True</Option>
           <Option name="pix_resetinbound">False</Option>
@@ -17783,10 +18314,10 @@ no sysopt nodnsalias outbound
           <Option name="pix_route_dnat">False</Option>
           <Option name="pix_set_host_name">False</Option>
           <Option name="pix_ssh_timeout">0</Option>
-          <Option name="pix_syslog_device_id_opt"></Option>
-          <Option name="pix_syslog_device_id_val"></Option>
-          <Option name="pix_syslog_facility"></Option>
-          <Option name="pix_syslog_host"></Option>
+          <Option name="pix_syslog_device_id_opt"/>
+          <Option name="pix_syslog_device_id_val"/>
+          <Option name="pix_syslog_facility"/>
+          <Option name="pix_syslog_host"/>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">0</Option>
           <Option name="pix_use_acl_remarks">False</Option>
@@ -17799,8 +18330,8 @@ no sysopt nodnsalias outbound
           <Option name="rpc_ss">0</Option>
           <Option name="rsh_fixup">2 514 0 nil 0</Option>
           <Option name="rtsp_fixup">2 554 0 nil 0</Option>
-          <Option name="scpArgs"></Option>
-          <Option name="script_env_path"></Option>
+          <Option name="scpArgs"/>
+          <Option name="script_env_path"/>
           <Option name="short_script">False</Option>
           <Option name="sip_fixup">2 5060 5060 nil 0</Option>
           <Option name="sip_hh">0</Option>
@@ -17812,11 +18343,11 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">2 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
-          <Option name="snmp_contact"></Option>
-          <Option name="snmp_description"></Option>
-          <Option name="snmp_location"></Option>
+          <Option name="snmp_contact"/>
+          <Option name="snmp_description"/>
+          <Option name="snmp_location"/>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
@@ -17857,6 +18388,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -17985,12 +18519,12 @@ no sysopt nodnsalias outbound
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"></Option>
-          <Option name="compiler"></Option>
+          <Option name="cmdline"/>
+          <Option name="compiler"/>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -17999,8 +18533,8 @@ no sysopt nodnsalias outbound
           <Option name="dns_fixup">2 65535 0 nil 0</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
-          <Option name="filesystem"></Option>
-          <Option name="firewall_dir"></Option>
+          <Option name="filesystem"/>
+          <Option name="firewall_dir"/>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ftp_fixup">2 21 0 strict 0</Option>
@@ -18017,9 +18551,9 @@ no sysopt nodnsalias outbound
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">2 389 389 nil 0</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"></Option>
-          <Option name="inst_script"></Option>
-          <Option name="install_script"></Option>
+          <Option name="inst_cmdline"/>
+          <Option name="inst_script"/>
+          <Option name="install_script"/>
           <Option name="ip_options_eool_fixup">0 0 0 nil 0</Option>
           <Option name="ip_options_nop_fixup">1 0 0 nil 0</Option>
           <Option name="ip_options_rtralt">2 0 0 nil 0</Option>
@@ -18036,22 +18570,22 @@ no sysopt nodnsalias outbound
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"></Option>
+          <Option name="log_prefix"/>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"></Option>
+          <Option name="mgmt_addr"/>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modulate_state">False</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="pass_all_out">False</Option>
           <Option name="pix_acl_basic">True</Option>
           <Option name="pix_acl_no_clear">False</Option>
           <Option name="pix_acl_substitution">False</Option>
-          <Option name="pix_acl_temp_addr"></Option>
+          <Option name="pix_acl_temp_addr"/>
           <Option name="pix_add_clear_statements">True</Option>
           <Option name="pix_assume_fw_part_of_any">True</Option>
           <Option name="pix_check_duplicate_nat">False</Option>
@@ -18063,7 +18597,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emb_limit">0</Option>
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"></Option>
+          <Option name="pix_epilog_script"/>
           <Option name="pix_floodguard">False</Option>
           <Option name="pix_fragguard">False</Option>
           <Option name="pix_generate_out_acl">False</Option>
@@ -18079,7 +18613,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
           <Option name="pix_optimize_default_nat">False</Option>
-          <Option name="pix_prolog_script"></Option>
+          <Option name="pix_prolog_script"/>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">True</Option>
           <Option name="pix_resetinbound">False</Option>
@@ -18087,10 +18621,10 @@ no sysopt nodnsalias outbound
           <Option name="pix_route_dnat">False</Option>
           <Option name="pix_set_host_name">False</Option>
           <Option name="pix_ssh_timeout">0</Option>
-          <Option name="pix_syslog_device_id_opt"></Option>
-          <Option name="pix_syslog_device_id_val"></Option>
-          <Option name="pix_syslog_facility"></Option>
-          <Option name="pix_syslog_host"></Option>
+          <Option name="pix_syslog_device_id_opt"/>
+          <Option name="pix_syslog_device_id_val"/>
+          <Option name="pix_syslog_facility"/>
+          <Option name="pix_syslog_host"/>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">0</Option>
           <Option name="pix_use_acl_remarks">False</Option>
@@ -18103,8 +18637,8 @@ no sysopt nodnsalias outbound
           <Option name="rpc_ss">0</Option>
           <Option name="rsh_fixup">2 514 0 nil 0</Option>
           <Option name="rtsp_fixup">2 554 0 nil 0</Option>
-          <Option name="scpArgs"></Option>
-          <Option name="script_env_path"></Option>
+          <Option name="scpArgs"/>
+          <Option name="script_env_path"/>
           <Option name="short_script">False</Option>
           <Option name="sip_fixup">2 5060 5060 nil 0</Option>
           <Option name="sip_hh">0</Option>
@@ -18116,11 +18650,11 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">2 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
-          <Option name="snmp_contact"></Option>
-          <Option name="snmp_description"></Option>
-          <Option name="snmp_location"></Option>
+          <Option name="snmp_contact"/>
+          <Option name="snmp_description"/>
+          <Option name="snmp_location"/>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
@@ -18161,6 +18695,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -18289,12 +18826,12 @@ no sysopt nodnsalias outbound
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"></Option>
-          <Option name="compiler"></Option>
+          <Option name="cmdline"/>
+          <Option name="compiler"/>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -18303,8 +18840,8 @@ no sysopt nodnsalias outbound
           <Option name="dns_fixup">2 65535 0 nil 0</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
-          <Option name="filesystem"></Option>
-          <Option name="firewall_dir"></Option>
+          <Option name="filesystem"/>
+          <Option name="firewall_dir"/>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ftp_fixup">2 21 0 strict 0</Option>
@@ -18321,9 +18858,9 @@ no sysopt nodnsalias outbound
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">2 389 389 nil 0</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"></Option>
-          <Option name="inst_script"></Option>
-          <Option name="install_script"></Option>
+          <Option name="inst_cmdline"/>
+          <Option name="inst_script"/>
+          <Option name="install_script"/>
           <Option name="ip_options_eool_fixup">0 0 0 nil 0</Option>
           <Option name="ip_options_nop_fixup">1 0 0 nil 0</Option>
           <Option name="ip_options_rtralt">2 0 0 nil 0</Option>
@@ -18340,22 +18877,22 @@ no sysopt nodnsalias outbound
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"></Option>
+          <Option name="log_prefix"/>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"></Option>
+          <Option name="mgmt_addr"/>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modulate_state">False</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="pass_all_out">False</Option>
           <Option name="pix_acl_basic">True</Option>
           <Option name="pix_acl_no_clear">False</Option>
           <Option name="pix_acl_substitution">False</Option>
-          <Option name="pix_acl_temp_addr"></Option>
+          <Option name="pix_acl_temp_addr"/>
           <Option name="pix_add_clear_statements">True</Option>
           <Option name="pix_assume_fw_part_of_any">True</Option>
           <Option name="pix_check_duplicate_nat">False</Option>
@@ -18367,7 +18904,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emb_limit">0</Option>
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"></Option>
+          <Option name="pix_epilog_script"/>
           <Option name="pix_floodguard">False</Option>
           <Option name="pix_fragguard">False</Option>
           <Option name="pix_generate_out_acl">False</Option>
@@ -18383,7 +18920,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
           <Option name="pix_optimize_default_nat">False</Option>
-          <Option name="pix_prolog_script"></Option>
+          <Option name="pix_prolog_script"/>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">True</Option>
           <Option name="pix_resetinbound">False</Option>
@@ -18391,10 +18928,10 @@ no sysopt nodnsalias outbound
           <Option name="pix_route_dnat">False</Option>
           <Option name="pix_set_host_name">False</Option>
           <Option name="pix_ssh_timeout">0</Option>
-          <Option name="pix_syslog_device_id_opt"></Option>
-          <Option name="pix_syslog_device_id_val"></Option>
-          <Option name="pix_syslog_facility"></Option>
-          <Option name="pix_syslog_host"></Option>
+          <Option name="pix_syslog_device_id_opt"/>
+          <Option name="pix_syslog_device_id_val"/>
+          <Option name="pix_syslog_facility"/>
+          <Option name="pix_syslog_host"/>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">0</Option>
           <Option name="pix_use_acl_remarks">False</Option>
@@ -18407,8 +18944,8 @@ no sysopt nodnsalias outbound
           <Option name="rpc_ss">0</Option>
           <Option name="rsh_fixup">2 514 0 nil 0</Option>
           <Option name="rtsp_fixup">2 554 0 nil 0</Option>
-          <Option name="scpArgs"></Option>
-          <Option name="script_env_path"></Option>
+          <Option name="scpArgs"/>
+          <Option name="script_env_path"/>
           <Option name="short_script">False</Option>
           <Option name="sip_fixup">2 5060 5060 nil 0</Option>
           <Option name="sip_hh">0</Option>
@@ -18420,11 +18957,11 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">2 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
-          <Option name="snmp_contact"></Option>
-          <Option name="snmp_description"></Option>
-          <Option name="snmp_location"></Option>
+          <Option name="snmp_contact"/>
+          <Option name="snmp_description"/>
+          <Option name="snmp_location"/>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
@@ -18465,6 +19002,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id20014X29963" disabled="False" group="" position="1" action="Translate" comment="">
@@ -18486,6 +19026,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id19941X29963" disabled="False" group="" position="2" action="Translate" comment="">
@@ -18507,6 +19050,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id178211X29963" disabled="False" group="" position="3" action="Translate" comment="">
@@ -18529,6 +19075,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions>
               <Option name="asa8_nat_dns">False</Option>
             </NATRuleOptions>
@@ -18552,6 +19101,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions>
               <Option name="asa8_nat_auto">True</Option>
               <Option name="asa8_nat_dns">False</Option>
@@ -18576,6 +19128,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions>
               <Option name="asa8_nat_dns">False</Option>
             </NATRuleOptions>
@@ -18599,6 +19154,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id130599X29063" disabled="False" group="" position="7" action="Translate" comment="For #1907&#10;">
@@ -18622,6 +19180,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions>
               <Option name="color">#C0BA44</Option>
             </NATRuleOptions>
@@ -18647,6 +19208,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions>
               <Option name="color">#C0BA44</Option>
             </NATRuleOptions>
@@ -18671,6 +19235,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions>
               <Option name="color">#C0BA44</Option>
             </NATRuleOptions>
@@ -18694,6 +19261,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions>
               <Option name="color">#C0BA44</Option>
             </NATRuleOptions>
@@ -18717,6 +19287,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions>
               <Option name="color">#C0BA44</Option>
             </NATRuleOptions>
@@ -18740,6 +19313,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions>
               <Option name="asa8_nat_auto">True</Option>
               <Option name="asa8_nat_dns">True</Option>
@@ -18765,6 +19341,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions>
               <Option name="asa8_nat_auto">True</Option>
               <Option name="asa8_nat_dns">True</Option>
@@ -18790,6 +19369,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions>
               <Option name="asa8_nat_auto">True</Option>
               <Option name="asa8_nat_dns">True</Option>
@@ -18815,6 +19397,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions>
               <Option name="asa8_nat_auto">True</Option>
               <Option name="asa8_nat_dns">False</Option>
@@ -18842,6 +19427,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions>
               <Option name="asa8_nat_auto">True</Option>
               <Option name="asa8_nat_dns">False</Option>
@@ -18869,6 +19457,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions>
               <Option name="asa8_nat_auto">True</Option>
               <Option name="asa8_nat_dns">False</Option>
@@ -18896,6 +19487,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions>
               <Option name="asa8_nat_auto">True</Option>
               <Option name="asa8_nat_dns">False</Option>
@@ -18923,6 +19517,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions>
               <Option name="asa8_nat_auto">True</Option>
               <Option name="asa8_nat_dns">False</Option>
@@ -18950,6 +19547,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions>
               <Option name="asa8_nat_auto">True</Option>
               <Option name="color">#7694C0</Option>
@@ -18974,6 +19574,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions>
               <Option name="asa8_nat_auto">False</Option>
               <Option name="asa8_nat_dns">False</Option>
@@ -19001,6 +19604,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="id3B4FF09A"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions>
               <Option name="asa8_nat_auto">True</Option>
               <Option name="asa8_nat_dns">False</Option>
@@ -19031,6 +19637,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions>
               <Option name="color">#C0C0C0</Option>
             </NATRuleOptions>
@@ -19054,6 +19663,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id315032X25872" disabled="False" group="" position="25" action="Translate" comment="for #1916&#10;&quot;static&quot; vs &quot;dynamic&quot; when TSrc is subnet&#10;">
@@ -19075,6 +19687,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions>
               <Option name="asa8_nat_auto">False</Option>
               <Option name="asa8_nat_dns">False</Option>
@@ -19193,12 +19808,12 @@ no sysopt nodnsalias outbound
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"></Option>
-          <Option name="compiler"></Option>
+          <Option name="cmdline"/>
+          <Option name="compiler"/>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -19207,8 +19822,8 @@ no sysopt nodnsalias outbound
           <Option name="dns_fixup">2 65535 0 nil 0</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
-          <Option name="filesystem"></Option>
-          <Option name="firewall_dir"></Option>
+          <Option name="filesystem"/>
+          <Option name="firewall_dir"/>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ftp_fixup">2 21 0 strict 0</Option>
@@ -19225,9 +19840,9 @@ no sysopt nodnsalias outbound
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">2 389 389 nil 0</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"></Option>
-          <Option name="inst_script"></Option>
-          <Option name="install_script"></Option>
+          <Option name="inst_cmdline"/>
+          <Option name="inst_script"/>
+          <Option name="install_script"/>
           <Option name="ip_options_eool_fixup">0 0 0 nil 0</Option>
           <Option name="ip_options_nop_fixup">1 0 0 nil 0</Option>
           <Option name="ip_options_rtralt">2 0 0 nil 0</Option>
@@ -19244,22 +19859,22 @@ no sysopt nodnsalias outbound
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"></Option>
+          <Option name="log_prefix"/>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"></Option>
+          <Option name="mgmt_addr"/>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modulate_state">False</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="pass_all_out">False</Option>
           <Option name="pix_acl_basic">True</Option>
           <Option name="pix_acl_no_clear">False</Option>
           <Option name="pix_acl_substitution">False</Option>
-          <Option name="pix_acl_temp_addr"></Option>
+          <Option name="pix_acl_temp_addr"/>
           <Option name="pix_add_clear_statements">True</Option>
           <Option name="pix_assume_fw_part_of_any">True</Option>
           <Option name="pix_check_duplicate_nat">False</Option>
@@ -19271,7 +19886,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emb_limit">0</Option>
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"></Option>
+          <Option name="pix_epilog_script"/>
           <Option name="pix_floodguard">False</Option>
           <Option name="pix_fragguard">False</Option>
           <Option name="pix_generate_out_acl">False</Option>
@@ -19287,7 +19902,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
           <Option name="pix_optimize_default_nat">False</Option>
-          <Option name="pix_prolog_script"></Option>
+          <Option name="pix_prolog_script"/>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">True</Option>
           <Option name="pix_resetinbound">False</Option>
@@ -19295,10 +19910,10 @@ no sysopt nodnsalias outbound
           <Option name="pix_route_dnat">False</Option>
           <Option name="pix_set_host_name">False</Option>
           <Option name="pix_ssh_timeout">0</Option>
-          <Option name="pix_syslog_device_id_opt"></Option>
-          <Option name="pix_syslog_device_id_val"></Option>
-          <Option name="pix_syslog_facility"></Option>
-          <Option name="pix_syslog_host"></Option>
+          <Option name="pix_syslog_device_id_opt"/>
+          <Option name="pix_syslog_device_id_val"/>
+          <Option name="pix_syslog_facility"/>
+          <Option name="pix_syslog_host"/>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">0</Option>
           <Option name="pix_use_acl_remarks">False</Option>
@@ -19311,8 +19926,8 @@ no sysopt nodnsalias outbound
           <Option name="rpc_ss">0</Option>
           <Option name="rsh_fixup">2 514 0 nil 0</Option>
           <Option name="rtsp_fixup">2 554 0 nil 0</Option>
-          <Option name="scpArgs"></Option>
-          <Option name="script_env_path"></Option>
+          <Option name="scpArgs"/>
+          <Option name="script_env_path"/>
           <Option name="short_script">False</Option>
           <Option name="sip_fixup">2 5060 5060 nil 0</Option>
           <Option name="sip_hh">0</Option>
@@ -19324,11 +19939,11 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">2 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
-          <Option name="snmp_contact"></Option>
-          <Option name="snmp_description"></Option>
-          <Option name="snmp_location"></Option>
+          <Option name="snmp_contact"/>
+          <Option name="snmp_description"/>
+          <Option name="snmp_location"/>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
@@ -19369,6 +19984,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id20491X3981" disabled="False" group="" position="1" action="Translate" comment="">
@@ -19390,6 +20008,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id455273X26333" disabled="False" group="" position="2" action="Translate" comment="">
@@ -19411,6 +20032,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id128151X3981" disabled="False" group="" position="3" action="Translate" comment="">
@@ -19432,6 +20056,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id183354X26333" disabled="False" group="" position="4" action="Translate" comment="">
@@ -19453,6 +20080,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="tcp-HTTP"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id128216X3981" disabled="False" group="" position="5" action="Translate" comment="">
@@ -19474,6 +20104,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="id3B4FF09A"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id347522X26910" disabled="False" group="" position="6" action="Translate" comment="">
@@ -19495,6 +20128,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="id3B4FED69"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id128251X3981" disabled="False" group="" position="7" action="Translate" comment="">
@@ -19516,6 +20152,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id456798X26910" disabled="False" group="" position="8" action="Translate" comment="">
@@ -19538,6 +20177,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="id3B4FED69"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id493377X26910" disabled="False" group="" position="9" action="Translate" comment="">
@@ -19560,6 +20202,9 @@ no sysopt nodnsalias outbound
               <ServiceRef ref="id3B4FED69"/>
               <ServiceRef ref="tcp-HTTP"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id28199X32583" disabled="False" group="" position="10" action="Translate" comment="for #1941&#10;">
@@ -19581,6 +20226,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions>
               <Option name="color">#C0BA44</Option>
             </NATRuleOptions>
@@ -19604,6 +20252,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions>
               <Option name="color">#C0BA44</Option>
             </NATRuleOptions>
@@ -19627,6 +20278,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions>
               <Option name="color">#C0BA44</Option>
             </NATRuleOptions>
@@ -19650,6 +20304,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions>
               <Option name="color">#C86E6E</Option>
             </NATRuleOptions>
@@ -19673,6 +20330,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions>
               <Option name="color">#C86E6E</Option>
             </NATRuleOptions>
@@ -19696,6 +20356,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions>
               <Option name="color">#C86E6E</Option>
             </NATRuleOptions>
@@ -19720,6 +20383,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions>
               <Option name="color">#C86E6E</Option>
             </NATRuleOptions>
@@ -19770,12 +20436,12 @@ no sysopt nodnsalias outbound
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"></Option>
-          <Option name="compiler"></Option>
+          <Option name="cmdline"/>
+          <Option name="compiler"/>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -19784,8 +20450,8 @@ no sysopt nodnsalias outbound
           <Option name="dns_fixup">2 65535 0 nil 0</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
-          <Option name="filesystem"></Option>
-          <Option name="firewall_dir"></Option>
+          <Option name="filesystem"/>
+          <Option name="firewall_dir"/>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ftp_fixup">2 21 0 strict 0</Option>
@@ -19802,9 +20468,9 @@ no sysopt nodnsalias outbound
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">2 389 389 nil 0</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"></Option>
-          <Option name="inst_script"></Option>
-          <Option name="install_script"></Option>
+          <Option name="inst_cmdline"/>
+          <Option name="inst_script"/>
+          <Option name="install_script"/>
           <Option name="ip_options_eool_fixup">0 0 0 nil 0</Option>
           <Option name="ip_options_nop_fixup">1 0 0 nil 0</Option>
           <Option name="ip_options_rtralt">2 0 0 nil 0</Option>
@@ -19821,22 +20487,22 @@ no sysopt nodnsalias outbound
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"></Option>
+          <Option name="log_prefix"/>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"></Option>
+          <Option name="mgmt_addr"/>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modulate_state">False</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="pass_all_out">False</Option>
           <Option name="pix_acl_basic">True</Option>
           <Option name="pix_acl_no_clear">False</Option>
           <Option name="pix_acl_substitution">False</Option>
-          <Option name="pix_acl_temp_addr"></Option>
+          <Option name="pix_acl_temp_addr"/>
           <Option name="pix_add_clear_statements">True</Option>
           <Option name="pix_assume_fw_part_of_any">True</Option>
           <Option name="pix_check_duplicate_nat">False</Option>
@@ -19848,7 +20514,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emb_limit">0</Option>
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"></Option>
+          <Option name="pix_epilog_script"/>
           <Option name="pix_floodguard">False</Option>
           <Option name="pix_fragguard">False</Option>
           <Option name="pix_generate_out_acl">False</Option>
@@ -19864,7 +20530,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
           <Option name="pix_optimize_default_nat">False</Option>
-          <Option name="pix_prolog_script"></Option>
+          <Option name="pix_prolog_script"/>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">True</Option>
           <Option name="pix_resetinbound">False</Option>
@@ -19872,10 +20538,10 @@ no sysopt nodnsalias outbound
           <Option name="pix_route_dnat">False</Option>
           <Option name="pix_set_host_name">False</Option>
           <Option name="pix_ssh_timeout">0</Option>
-          <Option name="pix_syslog_device_id_opt"></Option>
-          <Option name="pix_syslog_device_id_val"></Option>
-          <Option name="pix_syslog_facility"></Option>
-          <Option name="pix_syslog_host"></Option>
+          <Option name="pix_syslog_device_id_opt"/>
+          <Option name="pix_syslog_device_id_val"/>
+          <Option name="pix_syslog_facility"/>
+          <Option name="pix_syslog_host"/>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">0</Option>
           <Option name="pix_use_acl_remarks">False</Option>
@@ -19888,8 +20554,8 @@ no sysopt nodnsalias outbound
           <Option name="rpc_ss">0</Option>
           <Option name="rsh_fixup">2 514 0 nil 0</Option>
           <Option name="rtsp_fixup">2 554 0 nil 0</Option>
-          <Option name="scpArgs"></Option>
-          <Option name="script_env_path"></Option>
+          <Option name="scpArgs"/>
+          <Option name="script_env_path"/>
           <Option name="short_script">False</Option>
           <Option name="sip_fixup">2 5060 5060 nil 0</Option>
           <Option name="sip_hh">0</Option>
@@ -19901,11 +20567,11 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">2 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
-          <Option name="snmp_contact"></Option>
-          <Option name="snmp_description"></Option>
-          <Option name="snmp_location"></Option>
+          <Option name="snmp_contact"/>
+          <Option name="snmp_description"/>
+          <Option name="snmp_location"/>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
@@ -19946,6 +20612,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id20710X6113" disabled="False" group="" position="1" action="Translate" comment="">
@@ -19967,6 +20636,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id20546X6113" disabled="False" group="" position="2" action="Translate" comment="">
@@ -19988,6 +20660,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id20655X6113" disabled="False" group="" position="3" action="Translate" comment="">
@@ -20010,6 +20685,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <NATRule id="id20600X6113" disabled="False" group="" position="4" action="Translate" comment="">
@@ -20031,6 +20709,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -20079,12 +20760,12 @@ no sysopt nodnsalias outbound
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"></Option>
-          <Option name="compiler"></Option>
+          <Option name="cmdline"/>
+          <Option name="compiler"/>
           <Option name="conn_hh">1</Option>
           <Option name="conn_mm">0</Option>
           <Option name="conn_ss">0</Option>
@@ -20093,8 +20774,8 @@ no sysopt nodnsalias outbound
           <Option name="dns_fixup">2 65535 0 nil 0</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
-          <Option name="filesystem"></Option>
-          <Option name="firewall_dir"></Option>
+          <Option name="filesystem"/>
+          <Option name="firewall_dir"/>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ftp_fixup">2 21 0 strict 0</Option>
@@ -20111,9 +20792,9 @@ no sysopt nodnsalias outbound
           <Option name="ignore_empty_groups">False</Option>
           <Option name="ils_fixup">2 389 389 nil 0</Option>
           <Option name="in_out_code">True</Option>
-          <Option name="inst_cmdline"></Option>
-          <Option name="inst_script"></Option>
-          <Option name="install_script"></Option>
+          <Option name="inst_cmdline"/>
+          <Option name="inst_script"/>
+          <Option name="install_script"/>
           <Option name="ip_options_eool_fixup">0 0 0 nil 0</Option>
           <Option name="ip_options_nop_fixup">1 0 0 nil 0</Option>
           <Option name="ip_options_rtralt">2 0 0 nil 0</Option>
@@ -20130,22 +20811,22 @@ no sysopt nodnsalias outbound
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"></Option>
+          <Option name="log_prefix"/>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"></Option>
+          <Option name="mgmt_addr"/>
           <Option name="mgmt_ssh">False</Option>
           <Option name="modulate_state">False</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="pass_all_out">False</Option>
           <Option name="pix_acl_basic">True</Option>
           <Option name="pix_acl_no_clear">False</Option>
           <Option name="pix_acl_substitution">False</Option>
-          <Option name="pix_acl_temp_addr"></Option>
+          <Option name="pix_acl_temp_addr"/>
           <Option name="pix_add_clear_statements">True</Option>
           <Option name="pix_assume_fw_part_of_any">True</Option>
           <Option name="pix_check_duplicate_nat">False</Option>
@@ -20157,7 +20838,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emb_limit">0</Option>
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"></Option>
+          <Option name="pix_epilog_script"/>
           <Option name="pix_floodguard">False</Option>
           <Option name="pix_fragguard">False</Option>
           <Option name="pix_generate_out_acl">False</Option>
@@ -20173,7 +20854,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
           <Option name="pix_optimize_default_nat">False</Option>
-          <Option name="pix_prolog_script"></Option>
+          <Option name="pix_prolog_script"/>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">True</Option>
           <Option name="pix_resetinbound">False</Option>
@@ -20181,10 +20862,10 @@ no sysopt nodnsalias outbound
           <Option name="pix_route_dnat">False</Option>
           <Option name="pix_set_host_name">False</Option>
           <Option name="pix_ssh_timeout">0</Option>
-          <Option name="pix_syslog_device_id_opt"></Option>
-          <Option name="pix_syslog_device_id_val"></Option>
-          <Option name="pix_syslog_facility"></Option>
-          <Option name="pix_syslog_host"></Option>
+          <Option name="pix_syslog_device_id_opt"/>
+          <Option name="pix_syslog_device_id_val"/>
+          <Option name="pix_syslog_facility"/>
+          <Option name="pix_syslog_host"/>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">0</Option>
           <Option name="pix_use_acl_remarks">False</Option>
@@ -20197,8 +20878,8 @@ no sysopt nodnsalias outbound
           <Option name="rpc_ss">0</Option>
           <Option name="rsh_fixup">2 514 0 nil 0</Option>
           <Option name="rtsp_fixup">2 554 0 nil 0</Option>
-          <Option name="scpArgs"></Option>
-          <Option name="script_env_path"></Option>
+          <Option name="scpArgs"/>
+          <Option name="script_env_path"/>
           <Option name="short_script">False</Option>
           <Option name="sip_fixup">2 5060 5060 nil 0</Option>
           <Option name="sip_hh">0</Option>
@@ -20210,11 +20891,11 @@ no sysopt nodnsalias outbound
           <Option name="sip_udp_fixup">2 5060 0 nil 0</Option>
           <Option name="skinny_fixup">2 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
-          <Option name="snmp_contact"></Option>
-          <Option name="snmp_description"></Option>
-          <Option name="snmp_location"></Option>
+          <Option name="snmp_contact"/>
+          <Option name="snmp_description"/>
+          <Option name="snmp_location"/>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="ssh_timeout">5</Option>
           <Option name="telnet_timeout">5</Option>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
@@ -20255,6 +20936,9 @@ no sysopt nodnsalias outbound
             <TSrv neg="False">
               <ServiceRef ref="sysid1"/>
             </TSrv>
+            <ItfInb neg="False"><ObjectRef ref="sysid0"/></ItfInb>
+            <ItfOutb neg="False"><ObjectRef ref="sysid0"/></ItfOutb>
+            
             <NATRuleOptions/>
           </NATRule>
           <RuleSetOptions/>
@@ -20285,8 +20969,8 @@ no sysopt nodnsalias outbound
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
         <FirewallOptions>
-          <Option name="admUser"></Option>
-          <Option name="altAddress"></Option>
+          <Option name="admUser"/>
+          <Option name="altAddress"/>
           <Option name="check_shading">False</Option>
           <Option name="conn_hh">0</Option>
           <Option name="conn_mm">0</Option>
@@ -20294,8 +20978,8 @@ no sysopt nodnsalias outbound
           <Option name="ctiqbe_fixup">2 2748 0 nil 0</Option>
           <Option name="dns_fixup">2 65535 0 nil 0</Option>
           <Option name="espike_fixup">2 0 0 nil 0</Option>
-          <Option name="filesystem"></Option>
-          <Option name="firewall_dir"></Option>
+          <Option name="filesystem"/>
+          <Option name="firewall_dir"/>
           <Option name="ftp_fixup">2 21 0 strict 0</Option>
           <Option name="h323_h225_fixup">2 1720 1720 nil 0</Option>
           <Option name="h323_hh">0</Option>
@@ -20314,13 +20998,13 @@ no sysopt nodnsalias outbound
           <Option name="ip_options_rtralt_fixup">2 0 0 nil 0</Option>
           <Option name="ipv4_6_order">ipv4_first</Option>
           <Option name="mgcp_fixup">2 2427 2727 nil 0</Option>
-          <Option name="mgmt_addr"></Option>
+          <Option name="mgmt_addr"/>
           <Option name="mgmt_ssh">False</Option>
-          <Option name="output_file"></Option>
+          <Option name="output_file"/>
           <Option name="pix_acl_basic">True</Option>
           <Option name="pix_acl_no_clear">False</Option>
           <Option name="pix_acl_substitution">False</Option>
-          <Option name="pix_acl_temp_addr"></Option>
+          <Option name="pix_acl_temp_addr"/>
           <Option name="pix_add_clear_statements">true</Option>
           <Option name="pix_assume_fw_part_of_any">True</Option>
           <Option name="pix_check_duplicate_nat">False</Option>
@@ -20332,7 +21016,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_emb_limit">0</Option>
           <Option name="pix_emblem_log_format">False</Option>
           <Option name="pix_emulate_out_acl">True</Option>
-          <Option name="pix_epilog_script"></Option>
+          <Option name="pix_epilog_script"/>
           <Option name="pix_floodguard">True</Option>
           <Option name="pix_fragguard">False</Option>
           <Option name="pix_generate_out_acl">False</Option>
@@ -20347,7 +21031,7 @@ no sysopt nodnsalias outbound
           <Option name="pix_nodnsalias_inbound">False</Option>
           <Option name="pix_nodnsalias_outbound">False</Option>
           <Option name="pix_optimize_default_nat">False</Option>
-          <Option name="pix_prolog_script"></Option>
+          <Option name="pix_prolog_script"/>
           <Option name="pix_regroup_commands">False</Option>
           <Option name="pix_replace_natted_objects">False</Option>
           <Option name="pix_resetinbound">False</Option>
@@ -20357,11 +21041,11 @@ no sysopt nodnsalias outbound
           <Option name="pix_rule_syslog_settings">false</Option>
           <Option name="pix_security_fragguard_supported">true</Option>
           <Option name="pix_ssh_timeout">0</Option>
-          <Option name="pix_syslog_device_id_opt"></Option>
+          <Option name="pix_syslog_device_id_opt"/>
           <Option name="pix_syslog_device_id_supported">false</Option>
-          <Option name="pix_syslog_device_id_val"></Option>
-          <Option name="pix_syslog_facility"></Option>
-          <Option name="pix_syslog_host"></Option>
+          <Option name="pix_syslog_device_id_val"/>
+          <Option name="pix_syslog_facility"/>
+          <Option name="pix_syslog_host"/>
           <Option name="pix_syslog_queue_size">0</Option>
           <Option name="pix_telnet_timeout">0</Option>
           <Option name="pix_use_acl_remarks">True</Option>
@@ -20372,7 +21056,7 @@ no sysopt nodnsalias outbound
           <Option name="rpc_ss">0</Option>
           <Option name="rsh_fixup">2 514 0 nil 0</Option>
           <Option name="rtsp_fixup">2 554 0 nil 0</Option>
-          <Option name="scpArgs"></Option>
+          <Option name="scpArgs"/>
           <Option name="short_script">False</Option>
           <Option name="sip_fixup">2 5060 5060 nil 0</Option>
           <Option name="sip_hh">0</Option>
@@ -20385,7 +21069,7 @@ no sysopt nodnsalias outbound
           <Option name="skinny_fixup">2 2000 2000 nil 0</Option>
           <Option name="smtp_fixup">2 25 25 nil 0</Option>
           <Option name="sqlnet_fixup">2 1521 1521 nil 0</Option>
-          <Option name="sshArgs"></Option>
+          <Option name="sshArgs"/>
           <Option name="tftp_fixup">2 69 0 nil 0</Option>
           <Option name="uauth_abs">False</Option>
           <Option name="uauth_hh">0</Option>