diff --git a/doc/ChangeLog b/doc/ChangeLog
index a7965c200..49fbe587a 100644
--- a/doc/ChangeLog
+++ b/doc/ChangeLog
@@ -1,5 +1,8 @@
 2008-07-05  Vadim Kurland  <vadim@vk.crocodile.org>
 
+	* PolicyCompiler_pf_writers.cpp (PrintRule::_printDstService):
+	Support for tos matching in compiler for pf.
+
 	* PolicyCompiler_PrintRule.cpp (PrintRule::_printIP): Support for
 	TOS and DSCP matching in compiler for iptables.
 
diff --git a/src/pflib/PolicyCompiler_pf.cpp b/src/pflib/PolicyCompiler_pf.cpp
index 471ba3680..5cc6d5cf8 100644
--- a/src/pflib/PolicyCompiler_pf.cpp
+++ b/src/pflib/PolicyCompiler_pf.cpp
@@ -34,6 +34,7 @@
 #include "fwbuilder/ICMPService.h"
 #include "fwbuilder/TCPService.h"
 #include "fwbuilder/UDPService.h"
+#include "fwbuilder/TagService.h"
 #include "fwbuilder/Policy.h"
 #include "fwbuilder/Interface.h"
 #include "fwbuilder/Firewall.h"
@@ -875,53 +876,6 @@ bool PolicyCompiler_pf::splitIfInterfaceInRE::processNext()
     return true;
 }
 
-bool PolicyCompiler_pf::separateSrcPort::processNext()
-{
-    PolicyRule *rule=getNext(); if (rule==NULL) return false;
-
-    RuleElementSrv *rel= rule->getSrv();
-
-    if (rel->size()==1) {
-	tmp_queue.push_back(rule);
-	return true;
-    }
-
-    list<Service*> services;
-    for (FWObject::iterator i=rel->begin(); i!=rel->end(); i++) {
-	    
-	FWObject *o= *i;
-	if (FWReference::cast(o)!=NULL) o=FWReference::cast(o)->getPointer();
-	Service *s=Service::cast(o);
-	assert(s!=NULL);
-
-	if ( TCPService::isA(s) || UDPService::isA(s) ) {
-            int srs=TCPUDPService::cast(s)->getSrcRangeStart();
-            int sre=TCPUDPService::cast(s)->getSrcRangeEnd();
-
-            compiler->normalizePortRange(srs,sre);
-
-            if (srs!=0 || sre!=0) {
-                PolicyRule *r= PolicyRule::cast(
-                    compiler->dbcopy->create(PolicyRule::TYPENAME) );
-                compiler->temp_ruleset->add(r);
-                r->duplicate(rule);
-                RuleElementSrv *nsrv=r->getSrv();
-                nsrv->clearChildren();
-                nsrv->addRef( s );
-                tmp_queue.push_back(r);
-                services.push_back(s);
-            } 
-        }
-    }
-    for (list<Service*>::iterator i=services.begin(); i!=services.end(); i++) 
-	rel->removeRef( (*i) );
-
-    if (!rel->isAny())
-	tmp_queue.push_back(rule);
-
-    return true;
-}
-
 bool PolicyCompiler_pf::createTables::processNext()
 {
     PolicyCompiler_pf *pf_comp=dynamic_cast<PolicyCompiler_pf*>(compiler);
@@ -958,6 +912,83 @@ bool PolicyCompiler_pf::printScrubRule::processNext()
     return true;
 }
 
+
+
+
+
+
+PolicyCompiler_pf::separateServiceObject::separateServiceObject(
+    const string &name) : PolicyRuleProcessor(name)
+{
+}
+
+bool PolicyCompiler_pf::separateServiceObject::processNext()
+{
+    PolicyRule *rule=getNext(); if (rule==NULL) return false;
+
+    RuleElementSrv *rel= rule->getSrv();
+
+    if (rel->size()==1) {
+	tmp_queue.push_back(rule);
+	return true;
+    }
+
+    list<Service*> services;
+    for (FWObject::iterator i=rel->begin(); i!=rel->end(); i++)
+    {
+	FWObject *o= *i;
+	if (FWReference::cast(o)!=NULL) o=FWReference::cast(o)->getPointer();
+	Service *s=Service::cast(o);
+	assert(s!=NULL);
+
+	if (condition(s))
+        {
+            PolicyRule *r= PolicyRule::cast(
+                compiler->dbcopy->create(PolicyRule::TYPENAME) );
+            compiler->temp_ruleset->add(r);
+            r->duplicate(rule);
+            RuleElementSrv *nsrv=r->getSrv();
+            nsrv->clearChildren();
+            nsrv->addRef( s );
+            tmp_queue.push_back(r);
+            services.push_back(s);
+        }
+    }
+    for (list<Service*>::iterator i=services.begin(); i!=services.end(); i++) 
+	rel->removeRef( (*i) );
+
+    if (!rel->isAny())
+	tmp_queue.push_back(rule);
+
+    return true;
+}
+
+
+bool PolicyCompiler_pf::separateSrcPort::condition(const Service *srv)
+{
+    if ( TCPService::isA(srv) || UDPService::isA(srv) )
+    {
+        int srs = TCPUDPService::constcast(srv)->getSrcRangeStart();
+        int sre = TCPUDPService::constcast(srv)->getSrcRangeEnd();
+
+        compiler->normalizePortRange(srs,sre);
+
+        return (srs!=0 || sre!=0);
+    }
+    return false;
+}
+
+bool PolicyCompiler_pf::separateTagged::condition(const Service *srv)
+{
+    return ( TagService::isA(srv));
+}
+
+bool PolicyCompiler_pf::separateTOS::condition(const Service *srv)
+{
+    const IPService *ip = IPService::constcast(srv);
+    return (ip && !ip->getTOSCode().empty());
+}
+
 void PolicyCompiler_pf::compile()
 {
     cout << " Compiling " << fw->getName();
@@ -1066,10 +1097,10 @@ void PolicyCompiler_pf::compile()
         add( new InterfacePolicyRules(
                  "process interface policy rules and store interface ids") );
 
-	add( new splitIfFirewallInSrc(  "split rule if firewall is in Src"   ));
-	add( new splitIfFirewallInDst(  "split rule if firewall is in Dst"   ));
-	add( new fillDirection(         "determine directions"               ));
-	add( new SplitDirection(        "split rules with direction 'both'"  ));
+	add( new splitIfFirewallInSrc("split rule if firewall is in Src"   ));
+	add( new splitIfFirewallInDst("split rule if firewall is in Dst"   ));
+	add( new fillDirection("determine directions"               ));
+	add( new SplitDirection("split rules with direction 'both'"  ));
         add( new addLoopbackForRedirect(
                  "add loopback to rules that permit redirected services" ) );
 	add( new ExpandMultipleAddresses(
@@ -1077,12 +1108,15 @@ void PolicyCompiler_pf::compile()
         add( new dropRuleWithEmptyRE("drop rules with empty rule elements"));
         add( new checkForDynamicInterfacesOfOtherObjects(
                  "check for dynamic interfaces of other hosts and firewalls" ));
-        add( new MACFiltering(          "verify for MAC address filtering"   ));
-        add( new checkForUnnumbered(    "check for unnumbered interfaces"    ));
-	add( new addressRanges(         "expand address range objects"       ));
-	add( new splitServices(       "split rules with different protocols"));
+        add( new MACFiltering("verify for MAC address filtering"   ));
+        add( new checkForUnnumbered("check for unnumbered interfaces"    ));
+	add( new addressRanges("expand address range objects"       ));
+	add( new splitServices("split rules with different protocols"));
 	add( new separateTCPWithFlags("separate TCP services with flags"    ));
         add( new separateSrcPort("split on TCP and UDP with source ports"));
+        add( new separateTagged("split on TagService"));
+        add( new separateTOS("split on IPService with TOS"));
+
 	add( new verifyCustomServices(
                  "verify custom services for this platform"));
 //	add( new ProcessScrubOption(    "process 'scrub' option"         ));
diff --git a/src/pflib/PolicyCompiler_pf.h b/src/pflib/PolicyCompiler_pf.h
index 268eacc05..6aa99e23a 100644
--- a/src/pflib/PolicyCompiler_pf.h
+++ b/src/pflib/PolicyCompiler_pf.h
@@ -354,12 +354,55 @@ namespace fwcompiler {
                 eliminateDuplicatesInRE(n,libfwbuilder::RuleElementSrv::TYPENAME) {}
         };
 
+        /**
+	 * separate service object that satisfies condition
+	 * implemented in the virtual method "condition" so we have
+	 * exactly one such object per rule.
+	 */
+        class separateServiceObject : public PolicyRuleProcessor
+        {
+            protected:
+            virtual bool condition(const libfwbuilder::Service *srv) =0;
+            public:
+            separateServiceObject(const std::string &name);
+            virtual bool processNext();
+        };
+
 	/**
 	 * separate TCP/UDP services that specify source port (can
 	 * not be used in combination with destination port with
 	 * multiport)
 	 */
-        DECLARE_POLICY_RULE_PROCESSOR(separateSrcPort);
+        class separateSrcPort : public separateServiceObject
+        {
+            protected:
+            virtual bool condition(const libfwbuilder::Service *srv);
+            public:
+            separateSrcPort(const std::string &name) : separateServiceObject(name) {}
+        };
+        
+        /**
+	 * separate Tag services so we have exactly one per rule.
+	 */
+        class separateTagged : public separateServiceObject
+        {
+            protected:
+            virtual bool condition(const libfwbuilder::Service *srv);
+            public:
+            separateTagged(const std::string &name) : separateServiceObject(name) {}
+        };
+
+        /**
+	 * separate IPService objects with tos attrubute so we have
+	 * exactly one per rule.
+	 */
+        class separateTOS : public separateServiceObject
+        {
+            protected:
+            virtual bool condition(const libfwbuilder::Service *srv);
+            public:
+            separateTOS(const std::string &name) : separateServiceObject(name) {}
+        };
 
 
         class printScrubRule : public PolicyRuleProcessor
diff --git a/src/pflib/PolicyCompiler_pf_writers.cpp b/src/pflib/PolicyCompiler_pf_writers.cpp
index 72337ebe4..c8620dbbc 100644
--- a/src/pflib/PolicyCompiler_pf_writers.cpp
+++ b/src/pflib/PolicyCompiler_pf_writers.cpp
@@ -30,6 +30,7 @@
 #include "fwbuilder/RuleElement.h"
 #include "fwbuilder/IPService.h"
 #include "fwbuilder/ICMPService.h"
+#include "fwbuilder/ICMP6Service.h"
 #include "fwbuilder/TCPService.h"
 #include "fwbuilder/UDPService.h"
 #include "fwbuilder/CustomService.h"
@@ -543,7 +544,10 @@ void PolicyCompiler_pf::PrintRule::_printDstService(RuleElementSrv  *rel)
                 if (ICMPService::isA(srv)) 
                     compiler->output << "icmp-type " << str << " ";
                 else
-                    compiler->output << str << " ";
+                    if (ICMP6Service::isA(srv)) 
+                        compiler->output << "icmp6-type " << str << " ";
+                    else
+                        compiler->output << str << " ";
             }
 	}
 	if (TCPService::isA(srv)) 
@@ -551,9 +555,17 @@ void PolicyCompiler_pf::PrintRule::_printDstService(RuleElementSrv  *rel)
 	    str=_printTCPFlags(TCPService::cast(srv));
 	    if (!str.empty()) compiler->output << "flags " << str << " ";
 	}
-        if (IPService::isA(srv) &&
-            (srv->getBool("fragm") || srv->getBool("short_fragm")) )
+        if (IPService::isA(srv))
+        {
+            if (srv->getBool("fragm") || srv->getBool("short_fragm"))
                 compiler->output << " fragment ";
+            const IPService *ip = IPService::constcast(srv);
+            string tos = ip->getTOSCode();
+            string dscp = ip->getDSCPCode();
+            if (!tos.empty()) compiler->output << " tos " << tos;
+            if (!dscp.empty())
+                compiler->abort("PF does not support DSCP matching");
+        }
     } else 
     {
 	string str;
@@ -577,7 +589,10 @@ void PolicyCompiler_pf::PrintRule::_printDstService(RuleElementSrv  *rel)
                     compiler->output << "icmp-type { " << str << " } ";
                 else
                 {
-                    compiler->output << str << " " << endl;
+                    if (ICMP6Service::isA(srv)) 
+                        compiler->output << "icmp6-type { " << str << " } ";
+                    else
+                        compiler->output << str << " " << endl;
                 }
             }
 	}
diff --git a/test/pf/objects-for-regression-tests.fwb b/test/pf/objects-for-regression-tests.fwb
index 4b3152a5f..6c99e9831 100644
--- a/test/pf/objects-for-regression-tests.fwb
+++ b/test/pf/objects-for-regression-tests.fwb
@@ -1,20 +1,123 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
-<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="9" lastModified="1212808094" id="root">
-  <Library color="#d2ffd0" comment="User defined objects" id="syslib001" name="User" ro="False">
+<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="9" lastModified="1215308323" id="root">
+  <Library id="sysid99" name="Deleted Objects" ro="False">
+    <ICMP6Service id="idE0C27650" name="ipv6 dest unreachable" comment="No route to destination" code="0" type="1"/>
+    <Library id="id40E233F3" name="West Coast" color="#FFFFFF" ro="False">
+      <ObjectGroup id="id40E233F4" name="Objects">
+        <ObjectGroup id="id40E233F4_og_ats_1" name="Address Tables"/>
+        <ObjectGroup id="id40E233F5" name="Addresses"/>
+        <ObjectGroup id="id40E233F6" name="Groups">
+          <ObjectGroup id="id40E23403" name="West Coast Servers"/>
+        </ObjectGroup>
+        <ObjectGroup id="id40E233F7" name="Hosts"/>
+        <ObjectGroup id="id40E233F8" name="Networks"/>
+        <ObjectGroup id="id40E233F9" name="Address Ranges"/>
+      </ObjectGroup>
+      <ServiceGroup id="id40E233FA" name="Services">
+        <ServiceGroup id="id40E233FA_og_tag_1" name="TagServices"/>
+        <ServiceGroup id="id40E233FB" name="Groups"/>
+        <ServiceGroup id="id40E233FC" name="ICMP"/>
+        <ServiceGroup id="id40E233FD" name="IP"/>
+        <ServiceGroup id="id40E233FE" name="TCP"/>
+        <ServiceGroup id="id40E233FF" name="UDP"/>
+        <ServiceGroup id="id40E23400" name="Custom"/>
+        <ServiceGroup id="id40E233FA_userservices" name="Users"/>
+      </ServiceGroup>
+      <ObjectGroup id="id40E23401" name="Firewalls"/>
+      <IntervalGroup id="id40E23402" name="Time"/>
+    </Library>
+    <Library id="id40D07E7A" name="LAX" color="#FFFFFF" ro="False">
+      <ObjectGroup id="id40D07E7B" name="Objects">
+        <ObjectGroup id="id40D07E7B_og_ats_1" name="Address Tables"/>
+        <ObjectGroup id="id40D07E7C" name="Addresses">
+          <IPv4 id="id40E238E6" name="laxftp1" address="10.1.10.10" netmask="255.255.255.255"/>
+          <IPv4 id="id40E238E7" name="laxweb1" address="10.1.10.11" netmask="255.255.255.255"/>
+        </ObjectGroup>
+        <ObjectGroup id="id40D07E7D" name="Groups">
+          <ObjectGroup id="id40E23565" name="LAX Servers"/>
+        </ObjectGroup>
+        <ObjectGroup id="id40D07E7E" name="Hosts"/>
+        <ObjectGroup id="id40D07E7F" name="Networks"/>
+        <ObjectGroup id="id40D07E80" name="Address Ranges"/>
+      </ObjectGroup>
+      <ServiceGroup id="id40D07E81" name="Services">
+        <ServiceGroup id="id40D07E81_og_tag_1" name="TagServices"/>
+        <ServiceGroup id="id40D07E82" name="Groups"/>
+        <ServiceGroup id="id40D07E83" name="ICMP"/>
+        <ServiceGroup id="id40D07E84" name="IP"/>
+        <ServiceGroup id="id40D07E85" name="TCP"/>
+        <ServiceGroup id="id40D07E86" name="UDP"/>
+        <ServiceGroup id="id40D07E87" name="Custom"/>
+        <ServiceGroup id="id40D07E81_userservices" name="Users"/>
+      </ServiceGroup>
+      <ObjectGroup id="id40D07E88" name="Firewalls"/>
+      <IntervalGroup id="id40D07E89" name="Time"/>
+    </Library>
+    <Library id="id40C3E07E" name="SFO" color="#FFFFFF" ro="False">
+      <ObjectGroup id="id40C3E07F" name="Objects">
+        <ObjectGroup id="id40C3E07F_og_ats_1" name="Address Tables"/>
+        <ObjectGroup id="id40C3E081" name="Groups">
+          <ObjectGroup id="id40E23562" name="SFO Servers"/>
+        </ObjectGroup>
+        <ObjectGroup id="id40C3E080" name="Addresses">
+          <IPv4 id="id40E238E9" name="sfoweb1" address="10.2.10.11" netmask="255.255.255.255"/>
+          <IPv4 id="id40E238E8" name="sfoftp1" address="10.2.10.10" netmask="255.255.255.255"/>
+        </ObjectGroup>
+      </ObjectGroup>
+    </Library>
+    <Library id="id44EC13FB8791" name="tmp" color="#d2ffd0" ro="False">
+      <ObjectGroup id="id44EC13FC8791" name="Objects">
+        <ObjectGroup id="id44EC13FD8791" name="Addresses"/>
+        <ObjectGroup id="id44EC13FE8791" name="DNS Names"/>
+        <ObjectGroup id="id44EC13FF8791" name="Address Tables"/>
+        <ObjectGroup id="id44EC14008791" name="Groups"/>
+        <ObjectGroup id="id44EC14018791" name="Hosts"/>
+        <ObjectGroup id="id44EC14028791" name="Networks"/>
+        <ObjectGroup id="id44EC14038791" name="Address Ranges"/>
+      </ObjectGroup>
+      <ServiceGroup id="id44EC14048791" name="Services">
+        <ServiceGroup id="id44EC14058791" name="Groups"/>
+        <ServiceGroup id="id44EC14068791" name="ICMP"/>
+        <ServiceGroup id="id44EC14078791" name="IP"/>
+        <ServiceGroup id="id44EC14088791" name="TCP"/>
+        <ServiceGroup id="id44EC14098791" name="UDP"/>
+        <ServiceGroup id="id44EC140A8791" name="Custom"/>
+        <ServiceGroup id="id44EC140B8791" name="TagServices"/>
+        <ServiceGroup id="id44EC14048791_userservices" name="Users"/>
+      </ServiceGroup>
+      <ObjectGroup id="id44EC140C8791" name="Firewalls"/>
+      <IntervalGroup id="id44EC140D8791" name="Time"/>
+    </Library>
+    <AddressTable id="id44F7056328576" name="atbl" filename="/home/vadim/tmp/bug-1544488/addr-table-1.tbl" run_time="True"/>
+    <Interface id="id45DE9D012560" name="pcn1" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False">
+      <IPv4 id="id45DE9D032560" name="openbsd-4.0:pcn1:ip" address="10.1.1.1" netmask="255.255.255.0"/>
+    </Interface>
+    <Interface id="id4848A43B4626" name="ppp0" bridgeport="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False"/>
+    <ServiceRef ref="ip-IP_Fragments"/>
+    <ServiceRef ref="ip-IPSEC"/>
+    <ServiceRef ref="ip-IP_Fragments"/>
+    <ServiceRef ref="id3B58E3F1"/>
+    <ServiceRef ref="sysid1"/>
+    <ServiceRef ref="sysid1"/>
+    <ServiceRef ref="id3C6820443"/>
+    <ServiceRef ref="sysid1"/>
+    <ServiceRef ref="sysid1"/>
+  </Library>
+  <Library id="syslib001" name="User" comment="User defined objects" color="#d2ffd0" ro="False">
     <ObjectGroup id="stdid01_1" name="Objects">
       <ObjectGroup id="stdid01_1_og_ats_1" name="Address Tables">
-        <AddressTable comment="" filename="addr-table-1.tbl" id="id4389EE9018346" name="addr-table-1" run_time="False"/>
-        <AddressTable comment="this is run-time table" filename="block-hosts.tbl" id="id4389EE9118346" name="block these" run_time="True"/>
-        <AddressTable comment="empty file name; should generate code like this:&#10;&#10;table &lt;spammers&gt; persist&#10;&#10;without &quot;file 'blah'&quot;&#10;&#10;" filename="" id="id452762A75348" name="spammers" run_time="True"/>
+        <AddressTable id="id4389EE9018346" name="addr-table-1" filename="addr-table-1.tbl" run_time="False"/>
+        <AddressTable id="id4389EE9118346" name="block these" comment="this is run-time table" filename="block-hosts.tbl" run_time="True"/>
+        <AddressTable id="id452762A75348" name="spammers" comment="empty file name; should generate code like this:&#10;&#10;table &lt;spammers&gt; persist&#10;&#10;without &quot;file 'blah'&quot;&#10;&#10;" filename="" run_time="True"/>
       </ObjectGroup>
       <ObjectGroup id="stdid16_1" name="Addresses">
-        <IPv4 comment="" id="id4388C37D674" name="sapmhost1" address="61.150.47.112" netmask="255.255.255.255"/>
-        <IPv4 comment="" id="id446FCEEA10619" name="spamhost2" address="7.7.7.7" netmask="255.255.255.255"/>
-        <IPv4 comment="" id="id44F7082928576" name="some address" address="1.1.1.1" netmask="255.255.255.255"/>
-        <IPv6 comment="" id="id48416A7216880" name="6bone.net" address="2001:5c0:0:2::24" netmask="128"/>
-        <IPv6 comment="" id="id48416A7116880" name="altavista" address="3ffe:1200:2001:1:8000::1" netmask="128"/>
-        <IPv4 comment="" id="id417B3641" name="net_address" address="192.168.1.0" netmask="255.255.255.255"/>
+        <IPv4 id="id4388C37D674" name="sapmhost1" address="61.150.47.112" netmask="255.255.255.255"/>
+        <IPv4 id="id446FCEEA10619" name="spamhost2" address="7.7.7.7" netmask="255.255.255.255"/>
+        <IPv4 id="id44F7082928576" name="some address" address="1.1.1.1" netmask="255.255.255.255"/>
+        <IPv6 id="id48416A7216880" name="6bone.net" address="2001:5c0:0:2::24" netmask="128"/>
+        <IPv6 id="id48416A7116880" name="altavista" address="3ffe:1200:2001:1:8000::1" netmask="128"/>
+        <IPv4 id="id417B3641" name="net_address" address="192.168.1.0" netmask="255.255.255.255"/>
       </ObjectGroup>
       <ObjectGroup id="stdid04_1" name="Groups">
         <ObjectGroup id="id3B4572AF" name="group1">
@@ -43,28 +146,28 @@
         <ObjectGroup id="id3DE6946A" name="egroup2">
           <ObjectRef ref="id3DE69469"/>
         </ObjectGroup>
-        <ObjectGroup comment="this group is a combination of a regular address object and an address table in run-time mode" id="id4390C25525682" name="at group">
+        <ObjectGroup id="id4390C25525682" name="at group" comment="this group is a combination of a regular address object and an address table in run-time mode">
           <ObjectRef ref="id4388C37D674"/>
           <ObjectRef ref="id4389EE9118346"/>
           <ObjectRef ref="id446FB0EA10619"/>
           <ObjectRef ref="id446FCEEA10619"/>
         </ObjectGroup>
-        <ObjectGroup comment="" id="id446FB0EA10619" name="tbl group">
+        <ObjectGroup id="id446FB0EA10619" name="tbl group">
           <ObjectRef ref="id4389EE9018346"/>
         </ObjectGroup>
-        <ObjectGroup comment="" id="id4653861721432" name="f2i1,3">
+        <ObjectGroup id="id4653861721432" name="f2i1,3">
           <ObjectRef ref="id3AFB6706"/>
           <ObjectRef ref="id3AFB68D2"/>
         </ObjectGroup>
-        <ObjectGroup comment="" id="id4653B74121432" name="f2i1">
+        <ObjectGroup id="id4653B74121432" name="f2i1">
           <ObjectRef ref="id3AFB6706"/>
         </ObjectGroup>
-        <ObjectGroup comment="" id="id4834A2238571" name="ipv6 addresses">
+        <ObjectGroup id="id4834A2238571" name="ipv6 addresses">
           <ObjectRef ref="id48416A7016880"/>
           <ObjectRef ref="id48416A7216880"/>
           <ObjectRef ref="id48416A7116880"/>
         </ObjectGroup>
-        <ObjectGroup comment="" id="id4834A2278571" name="ipv4 ipv6 addresses">
+        <ObjectGroup id="id4834A2278571" name="ipv4 ipv6 addresses">
           <ObjectRef ref="id417B3641"/>
           <ObjectRef ref="id4388C37D674"/>
           <ObjectRef ref="id48416A7216880"/>
@@ -72,16 +175,16 @@
         </ObjectGroup>
       </ObjectGroup>
       <ObjectGroup id="stdid02_1" name="Hosts">
-        <Host comment="broadcast on internal subnet" id="id3B64FFAC" name="broadcast">
-          <Interface bridgeport="False" dyn="False" id="id3B64FFAC-i" name="unknown" security_level="100" unnum="False" unprotected="False">
+        <Host id="id3B64FFAC" name="broadcast" comment="broadcast on internal subnet">
+          <Interface id="id3B64FFAC-i" name="unknown" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
             <IPv4 id="id3B64FFAC-i-ipv4" name="address" address="192.168.1.255" netmask="255.255.255.255"/>
           </Interface>
           <HostOptions>
             <Option name="use_mac_addr_filter">false</Option>
           </HostOptions>
         </Host>
-        <Host comment="" id="host-hostA" name="hostA">
-          <Interface bridgeport="False" dyn="False" id="host-hostA-i" label="" name="hostA_eth0" security_level="100" unnum="False" unprotected="False">
+        <Host id="host-hostA" name="hostA">
+          <Interface id="host-hostA-i" name="hostA_eth0" bridgeport="False" dyn="False" label="" security_level="100" unnum="False" unprotected="False">
             <IPv4 id="host-hostA-i-ipv4" name="address" address="192.168.1.10" netmask="255.255.255.255"/>
           </Interface>
           <Management address="192.168.1.10">
@@ -96,8 +199,8 @@
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
-        <Host comment="" id="id3B3D5A3B" name="hostA-2">
-          <Interface bridgeport="False" dyn="False" id="id3B3D5A3B-i" name="interface-1" security_level="0" unnum="False" unprotected="False">
+        <Host id="id3B3D5A3B" name="hostA-2">
+          <Interface id="id3B3D5A3B-i" name="interface-1" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
             <IPv4 id="id3B3D5A3B-i-1-addr" name="address" address="192.168.1.10" netmask="255.255.255.255"/>
           </Interface>
           <Management address="192.168.1.10">
@@ -112,16 +215,16 @@
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
-        <Host comment="translated address for hostA" id="id3AFADBF9" name="hostA-NAT">
-          <Interface bridgeport="False" dyn="False" id="id3AFADBF9-i" name="unknown" security_level="100" unnum="False" unprotected="False">
+        <Host id="id3AFADBF9" name="hostA-NAT" comment="translated address for hostA">
+          <Interface id="id3AFADBF9-i" name="unknown" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
             <IPv4 id="id3AFADBF9-i-ipv4" name="address" address="22.22.22.23" netmask="255.255.255.255"/>
           </Interface>
           <HostOptions>
             <Option name="use_mac_addr_filter">false</Option>
           </HostOptions>
         </Host>
-        <Host comment="" id="host-hostB" name="hostB">
-          <Interface bridgeport="False" dyn="False" id="host-hostB-i" name="unknown" security_level="100" unnum="False" unprotected="False">
+        <Host id="host-hostB" name="hostB">
+          <Interface id="host-hostB-i" name="unknown" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
             <IPv4 id="host-hostB-i-ipv4" name="address" address="192.168.1.20" netmask="255.255.255.255"/>
           </Interface>
           <Management address="192.168.1.20">
@@ -133,40 +236,40 @@
             <Option name="use_mac_addr_filter">false</Option>
           </HostOptions>
         </Host>
-        <Host comment="" id="id3BD6736B" name="hostB-NAT">
-          <Interface bridgeport="False" dyn="False" id="id3BD6736B-i" name="unknown" security_level="100" unnum="False" unprotected="False">
+        <Host id="id3BD6736B" name="hostB-NAT">
+          <Interface id="id3BD6736B-i" name="unknown" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
             <IPv4 id="id3BD6736B-i-ipv4" name="address" address="22.22.23.24" netmask="255.255.255.255"/>
           </Interface>
           <HostOptions>
             <Option name="use_mac_addr_filter">false</Option>
           </HostOptions>
         </Host>
-        <Host comment="this host has the same IP address as firewall1 and firewall2" id="id3AFC0F70" name="host-fw2">
-          <Interface bridgeport="False" dyn="False" id="id3AFC0F70-i" name="unknown" security_level="100" unnum="False" unprotected="False">
-            <IPv4 comment="" id="id3AFC0F70-i-ipv4" name="host-fw2-addr" address="22.22.22.22" netmask="255.255.255.255"/>
+        <Host id="id3AFC0F70" name="host-fw2" comment="this host has the same IP address as firewall1 and firewall2">
+          <Interface id="id3AFC0F70-i" name="unknown" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
+            <IPv4 id="id3AFC0F70-i-ipv4" name="host-fw2-addr" address="22.22.22.22" netmask="255.255.255.255"/>
           </Interface>
           <HostOptions>
             <Option name="use_mac_addr_filter">false</Option>
           </HostOptions>
         </Host>
-        <Host comment="the same address as internal iface of firewall1" id="id3AFC191C" name="hostF-int">
-          <Interface bridgeport="False" dyn="False" id="id3AFC191C-i" name="unknown" security_level="100" unnum="False" unprotected="False">
+        <Host id="id3AFC191C" name="hostF-int" comment="the same address as internal iface of firewall1">
+          <Interface id="id3AFC191C-i" name="unknown" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
             <IPv4 id="id3AFC191C-i-ipv4" name="address" address="192.168.1.1" netmask="255.255.255.255"/>
           </Interface>
           <HostOptions>
             <Option name="use_mac_addr_filter">false</Option>
           </HostOptions>
         </Host>
-        <Host comment="some host outside our network" id="id3B19C5EB" name="outside-host">
-          <Interface bridgeport="False" dyn="False" id="id3B19C5EB-i" name="unknown" security_level="100" unnum="False" unprotected="False">
+        <Host id="id3B19C5EB" name="outside-host" comment="some host outside our network">
+          <Interface id="id3B19C5EB-i" name="unknown" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
             <IPv4 id="id3B19C5EB-i-ipv4" name="address" address="200.200.200.200" netmask="255.255.255.255"/>
           </Interface>
           <HostOptions>
             <Option name="use_mac_addr_filter">false</Option>
           </HostOptions>
         </Host>
-        <Host comment="" id="host-secondary1-com" name="secondary1.com">
-          <Interface bridgeport="False" dyn="False" id="host-secondary1-com-i" name="unknown" security_level="100" unnum="False" unprotected="False">
+        <Host id="host-secondary1-com" name="secondary1.com">
+          <Interface id="host-secondary1-com-i" name="unknown" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
             <IPv4 id="host-secondary1-com-i-ipv4" name="address" address="211.11.11.11" netmask="255.255.255.255"/>
           </Interface>
           <Management address="211.11.11.11">
@@ -178,8 +281,8 @@
             <Option name="use_mac_addr_filter">false</Option>
           </HostOptions>
         </Host>
-        <Host comment="" id="host-secondary2-com" name="secondary2.com">
-          <Interface bridgeport="False" dyn="False" id="host-secondary2-com-i" name="unknown" security_level="100" unnum="False" unprotected="False">
+        <Host id="host-secondary2-com" name="secondary2.com">
+          <Interface id="host-secondary2-com-i" name="unknown" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
             <IPv4 id="host-secondary2-com-i-ipv4" name="address" address="211.22.22.22" netmask="255.255.255.255"/>
           </Interface>
           <Management address="211.22.22.22">
@@ -191,10 +294,10 @@
             <Option name="use_mac_addr_filter">false</Option>
           </HostOptions>
         </Host>
-        <Host comment="" id="id3BF1B3E1" name="host-with_mac">
-          <Interface bridgeport="False" dyn="False" id="id3BF1B3E2" label="" name="unknown" security_level="100" unnum="False" unprotected="False">
+        <Host id="id3BF1B3E1" name="host-with_mac">
+          <Interface id="id3BF1B3E2" name="unknown" bridgeport="False" dyn="False" label="" security_level="100" unnum="False" unprotected="False">
             <IPv4 id="id3BF1B3E2-ipv4" name="address" address="192.168.1.10" netmask="255.255.255.0"/>
-            <physAddress address="00:10:4b:de:e9:6f" id="id3BF1B3E2-pa" name="unknown-pa"/>
+            <physAddress id="id3BF1B3E2-pa" name="unknown-pa" address="00:10:4b:de:e9:6f"/>
           </Interface>
           <Management address="192.168.1.10">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -205,10 +308,10 @@
             <Option name="use_mac_addr_filter">True</Option>
           </HostOptions>
         </Host>
-        <Host comment="" id="id3BF1B3E7" name="host-with_mac-2">
-          <Interface bridgeport="False" dyn="False" id="id3BF1B3E8" label="" name="unknown" security_level="100" unnum="False" unprotected="False">
-            <IPv4 comment="" id="id3BF1B3E8-ipv4" name="host-with_mac-2:addr" address="0.0.0.0" netmask="0.0.0.0"/>
-            <physAddress address="00:10:4b:de:e9:6f" id="id3BF1B3E8-pa" name="unknown-pa"/>
+        <Host id="id3BF1B3E7" name="host-with_mac-2">
+          <Interface id="id3BF1B3E8" name="unknown" bridgeport="False" dyn="False" label="" security_level="100" unnum="False" unprotected="False">
+            <IPv4 id="id3BF1B3E8-ipv4" name="host-with_mac-2:addr" address="0.0.0.0" netmask="0.0.0.0"/>
+            <physAddress id="id3BF1B3E8-pa" name="unknown-pa" address="00:10:4b:de:e9:6f"/>
           </Interface>
           <Management address="0.0.0.0">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -222,10 +325,10 @@
             <Option name="use_mac_addr_filter">True</Option>
           </HostOptions>
         </Host>
-        <Host comment="" id="id3BF23930" name="z-host">
-          <Interface bridgeport="False" dyn="False" id="id3BF23931" label="" name="unknown" security_level="100" unnum="False" unprotected="False">
+        <Host id="id3BF23930" name="z-host">
+          <Interface id="id3BF23931" name="unknown" bridgeport="False" dyn="False" label="" security_level="100" unnum="False" unprotected="False">
             <IPv4 id="id3BF23931-ipv4" name="address" address="0.0.0.0" netmask="0.0.0.0"/>
-            <physAddress address="00:a0:24:53:06:8c" id="id3BF23931-pa" name="unknown-pa"/>
+            <physAddress id="id3BF23931-pa" name="unknown-pa" address="00:a0:24:53:06:8c"/>
           </Interface>
           <Management address="0.0.0.0">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -239,8 +342,8 @@
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
-        <Host comment="" id="id3CD87A53" name="n192.168.1.11">
-          <Interface bridgeport="False" dyn="False" id="id3CD87A53-i" name="interface-1" security_level="0" unnum="False" unprotected="False">
+        <Host id="id3CD87A53" name="n192.168.1.11">
+          <Interface id="id3CD87A53-i" name="interface-1" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
             <IPv4 id="id3CD87A53-i-1-addr" name="address" address="192.168.1.11" netmask="255.255.255.255"/>
           </Interface>
           <Management address="192.168.1.11">
@@ -256,8 +359,8 @@
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
-        <Host comment="" id="id3CD87A5E" name="n192.168.1.12">
-          <Interface bridgeport="False" dyn="False" id="id3CD87A5E-i" name="interface-1" security_level="0" unnum="False" unprotected="False">
+        <Host id="id3CD87A5E" name="n192.168.1.12">
+          <Interface id="id3CD87A5E-i" name="interface-1" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
             <IPv4 id="id3CD87A5E-i-1-addr" name="address" address="192.168.1.12" netmask="255.255.255.255"/>
           </Interface>
           <Management address="192.168.1.12">
@@ -273,8 +376,8 @@
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
-        <Host comment="" id="id3CD87A6D" name="n192.168.1.13">
-          <Interface bridgeport="False" dyn="False" id="id3CD87A6D-i" name="interface-1" security_level="0" unnum="False" unprotected="False">
+        <Host id="id3CD87A6D" name="n192.168.1.13">
+          <Interface id="id3CD87A6D-i" name="interface-1" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
             <IPv4 id="id3CD87A6D-i-1-addr" name="address" address="192.168.1.13" netmask="255.255.255.255"/>
           </Interface>
           <Management address="192.168.1.13">
@@ -290,8 +393,8 @@
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
-        <Host comment="" id="id3CD87A7C" name="n192.168.1.14">
-          <Interface bridgeport="False" dyn="False" id="id3CD87A7C-i" name="interface-1" security_level="0" unnum="False" unprotected="False">
+        <Host id="id3CD87A7C" name="n192.168.1.14">
+          <Interface id="id3CD87A7C-i" name="interface-1" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
             <IPv4 id="id3CD87A7C-i-1-addr" name="address" address="192.168.1.14" netmask="255.255.255.255"/>
           </Interface>
           <Management address="192.168.1.14">
@@ -307,8 +410,8 @@
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
-        <Host comment="" id="id3CD87A8B" name="n192.168.1.15">
-          <Interface bridgeport="False" dyn="False" id="id3CD87A8B-i" name="interface-1" security_level="0" unnum="False" unprotected="False">
+        <Host id="id3CD87A8B" name="n192.168.1.15">
+          <Interface id="id3CD87A8B-i" name="interface-1" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
             <IPv4 id="id3CD87A8B-i-1-addr" name="address" address="192.168.1.15" netmask="255.255.255.255"/>
           </Interface>
           <Management address="192.168.1.15">
@@ -324,8 +427,8 @@
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
-        <Host comment="" id="id3D58118B" name="hostC">
-          <Interface bridgeport="False" dyn="False" id="id3D58118B-i" name="interface-1" security_level="0" unnum="False" unprotected="False">
+        <Host id="id3D58118B" name="hostC">
+          <Interface id="id3D58118B-i" name="interface-1" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
             <IPv4 id="id3D58118B-i-1-addr" name="address" address="192.168.1.100" netmask="255.255.255.255"/>
           </Interface>
           <Management address="192.168.1.100">
@@ -341,9 +444,9 @@
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
-        <Host comment="" id="id3D58118F" name="hostC-1">
-          <Interface bridgeport="False" comment="" dyn="False" id="id3D581193" label="" name="eth0" security_level="0" unnum="False" unprotected="False">
-            <IPv4 comment="" id="id3D581194" name="hostC-1:eth0" address="192.168.1.100" netmask="255.255.255.0"/>
+        <Host id="id3D58118F" name="hostC-1">
+          <Interface id="id3D581193" name="eth0" bridgeport="False" dyn="False" label="" security_level="0" unnum="False" unprotected="False">
+            <IPv4 id="id3D581194" name="hostC-1:eth0" address="192.168.1.100" netmask="255.255.255.0"/>
           </Interface>
           <Management address="192.168.1.100">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -359,7 +462,7 @@
           </HostOptions>
         </Host>
         <Host id="id3E7ABEC4" name="nat-addr1">
-          <Interface bridgeport="False" dyn="False" id="id3E7ABEC6" name="interface1" security_level="0" unnum="False" unprotected="False">
+          <Interface id="id3E7ABEC6" name="interface1" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
             <IPv4 id="id3E7ABEC7" name="nat-addr1:interface1(ip)" address="22.22.22.50" netmask="255.255.255.255"/>
           </Interface>
           <Management address="0.0.0.0">
@@ -372,7 +475,7 @@
           </HostOptions>
         </Host>
         <Host id="id3E7ABECA" name="nat-addr2">
-          <Interface bridgeport="False" dyn="False" id="id3E7ABECC" name="interface1" security_level="0" unnum="False" unprotected="False">
+          <Interface id="id3E7ABECC" name="interface1" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
             <IPv4 id="id3E7ABECD" name="nat-addr2:interface1(ip)" address="22.22.22.51" netmask="255.255.255.255"/>
           </Interface>
           <Management address="0.0.0.0">
@@ -385,7 +488,7 @@
           </HostOptions>
         </Host>
         <Host id="id3EE25A56" name="dyn host">
-          <Interface bridgeport="False" dyn="True" id="id3EE25A58" name="eth0" security_level="0" unnum="False" unprotected="False"/>
+          <Interface id="id3EE25A58" name="eth0" bridgeport="False" dyn="True" security_level="0" unnum="False" unprotected="False"/>
           <Management address="0.0.0.0">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
             <FWBDManagement enabled="False" identity="" port="-1"/>
@@ -397,35 +500,36 @@
         </Host>
       </ObjectGroup>
       <ObjectGroup id="stdid03_1" name="Networks">
-        <Network comment="" id="net-Internal_net" name="Internal_net" address="192.168.1.0" netmask="255.255.255.0"/>
-        <Network comment="DMZ net - using NAT" id="id3B022266" name="dmz_net" address="192.168.2.0" netmask="255.255.255.0"/>
-        <Network comment="" id="id3B665641" name="external_net" address="22.22.22.0" netmask="255.255.255.0"/>
-        <Network comment="" id="id3B665643" name="foreign_net" address="33.33.33.0" netmask="255.255.255.0"/>
-        <Network comment="" id="id3FDCD983" name="foreign_net2" address="33.33.44.0" netmask="255.255.255.0"/>
-        <Network comment="" id="id43F7DCF631316" name="22.22.22/28" address="22.22.22.0" netmask="255.255.255.240"/>
-        <NetworkIPv6 comment="" id="id4834B9206131" name="net-fe80" address="fe80::" netmask="64"/>
-        <NetworkIPv6 comment="" id="id48416A7016880" name="DIGITAL-CA-DEC" address="3ffe:1200:2000::" netmask="36"/>
-        <Network comment="" id="id3CEBFDFC" name="n-192.168.1.0" address="192.168.1.0" netmask="255.255.255.0"/>
-        <Network comment="" id="id4733FFE419714" name="n-192.168.2.0" address="192.168.2.0" netmask="255.255.255.0"/>
+        <Network id="net-Internal_net" name="Internal_net" address="192.168.1.0" netmask="255.255.255.0"/>
+        <Network id="id3B022266" name="dmz_net" comment="DMZ net - using NAT" address="192.168.2.0" netmask="255.255.255.0"/>
+        <Network id="id3B665641" name="external_net" address="22.22.22.0" netmask="255.255.255.0"/>
+        <Network id="id3B665643" name="foreign_net" address="33.33.33.0" netmask="255.255.255.0"/>
+        <Network id="id3FDCD983" name="foreign_net2" address="33.33.44.0" netmask="255.255.255.0"/>
+        <Network id="id43F7DCF631316" name="22.22.22/28" address="22.22.22.0" netmask="255.255.255.240"/>
+        <NetworkIPv6 id="id4834B9206131" name="net-fe80" address="fe80::" netmask="64"/>
+        <NetworkIPv6 id="id48416A7016880" name="DIGITAL-CA-DEC" address="3ffe:1200:2000::" netmask="36"/>
+        <Network id="id3CEBFDFC" name="n-192.168.1.0" address="192.168.1.0" netmask="255.255.255.0"/>
+        <Network id="id4733FFE419714" name="n-192.168.2.0" address="192.168.2.0" netmask="255.255.255.0"/>
       </ObjectGroup>
       <ObjectGroup id="stdid15_1" name="Address Ranges">
-        <AddressRange comment="" id="id3CD8769F" name="test_range_1" start_address="192.168.1.11" end_address="192.168.1.15"/>
-        <AddressRange comment="" id="id43F7DCF831316" name="22.22.22.1-22.22.22.5" start_address="22.22.22.1" end_address="22.22.22.5"/>
+        <AddressRange id="id3CD8769F" name="test_range_1" start_address="192.168.1.11" end_address="192.168.1.15"/>
+        <AddressRange id="id43F7DCF831316" name="22.22.22.1-22.22.22.5" start_address="22.22.22.1" end_address="22.22.22.5"/>
       </ObjectGroup>
       <ObjectGroup id="id4386458A18448" name="DNS Names">
-        <DNSName comment="an example of a local host" dnsrec="buildmaster" dnsrectype="A" id="id43869E8E18346" name="buildmaster (ct)" run_time="False"/>
-        <DNSName comment="an example of a local host" dnsrec="buildmaster" dnsrectype="A" id="id43869E8F18346" name="buildmaster (rt)" run_time="True"/>
-        <DNSName comment="" dnsrec="www.cnn.com" dnsrectype="A" id="id43869E8C18346" name="cnn (ct)" run_time="False"/>
-        <DNSName comment="" dnsrec="www.cnn.com" dnsrectype="A" id="id43869E8D18346" name="cnn (rt)" run_time="True"/>
-        <DNSName comment="" dnsrec="www.google.com" dnsrectype="A" id="id4387287918346" name="google (ct)" run_time="False"/>
-        <DNSName comment="" dnsrec="www.google.com" dnsrectype="A" id="id4387287A18346" name="google (rt)" run_time="True"/>
-        <DNSName comment="" dnsrec="www.heise.de" dnsrectype="A" id="id44EC181D8791" name="heise" run_time="True"/>
+        <DNSName id="id43869E8E18346" name="buildmaster (ct)" comment="an example of a local host" dnsrec="buildmaster" dnsrectype="A" run_time="False"/>
+        <DNSName id="id43869E8F18346" name="buildmaster (rt)" comment="an example of a local host" dnsrec="buildmaster" dnsrectype="A" run_time="True"/>
+        <DNSName id="id43869E8C18346" name="cnn (ct)" dnsrec="www.cnn.com" dnsrectype="A" run_time="False"/>
+        <DNSName id="id43869E8D18346" name="cnn (rt)" dnsrec="www.cnn.com" dnsrectype="A" run_time="True"/>
+        <DNSName id="id4387287918346" name="google (ct)" dnsrec="www.google.com" dnsrectype="A" run_time="False"/>
+        <DNSName id="id4387287A18346" name="google (rt)" dnsrec="www.google.com" dnsrectype="A" run_time="True"/>
+        <DNSName id="id44EC181D8791" name="heise" dnsrec="www.heise.de" dnsrectype="A" run_time="True"/>
       </ObjectGroup>
     </ObjectGroup>
     <ServiceGroup id="stdid05_1" name="Services">
       <ServiceGroup id="stdid05_1_og_tag_1" name="TagServices">
-        <TagService comment="" id="id43EC6B892355" name="ipsec_tag" tagcode="ipsec_tag"/>
-        <TagService comment="" id="id43F4556A28869" name="INTNET" tagcode="INTNET"/>
+        <TagService id="id43EC6B892355" name="ipsec_tag" tagcode="ipsec_tag"/>
+        <TagService id="id43F4556A28869" name="INTNET" tagcode="INTNET"/>
+        <TagService id="id1391120443" name="tag2" tagcode="tag2"/>
       </ServiceGroup>
       <ServiceGroup id="stdid10_1" name="Groups">
         <ServiceGroup id="id3B457567" name="svcgroup1">
@@ -483,29 +587,32 @@
         <ServiceGroup id="id3DE6946C" name="sgroup"/>
       </ServiceGroup>
       <ServiceGroup id="stdid07_1" name="ICMP">
-        <ICMPService code="-1" comment="" id="id3C1A5D46" name="any ICMP" type="-1"/>
-        <ICMPService code="-1" comment="" id="id3D0E95E4" name="Any unreach." type="3"/>
+        <ICMPService id="id3C1A5D46" name="any ICMP" code="-1" type="-1"/>
+        <ICMPService id="id3D0E95E4" name="Any unreach." code="-1" type="3"/>
       </ServiceGroup>
       <ServiceGroup id="stdid06_1" name="IP">
-        <IPService comment="" fragm="False" id="id3B457561" lsrr="False" name="ICMP" protocol_num="1" rr="False" short_fragm="False" ssrr="False" ts="False"/>
-        <IPService comment="" fragm="False" id="id3B6659A5" lsrr="False" name="TS" protocol_num="0" rr="False" short_fragm="False" ssrr="False" ts="True"/>
+        <IPService id="id3B457561" name="ICMP" fragm="False" lsrr="False" protocol_num="1" rr="False" short_fragm="False" ssrr="False" ts="False"/>
+        <IPService id="id3B6659A5" name="TS" fragm="False" lsrr="False" protocol_num="0" rr="False" short_fragm="False" ssrr="False" ts="True"/>
+        <IPService id="id3C6820443" name="tos 0x20" dscp="" fragm="False" lsrr="False" protocol_num="0" rr="False" short_fragm="False" ssrr="False" tos="0x20" ts="False"/>
+        <IPService id="id3C6920443" name="dscp 0x20" dscp="0x20" fragm="False" lsrr="False" protocol_num="0" rr="False" short_fragm="False" ssrr="False" tos="" ts="False"/>
+        <IPService id="idC5F120443" name="tos 0x10" dscp="" fragm="False" lsrr="False" protocol_num="0" rr="False" short_fragm="False" ssrr="False" tos="0x10" ts="False"/>
       </ServiceGroup>
       <ServiceGroup id="stdid09_1" name="TCP">
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="6667" dst_range_start="6667" fin_flag="False" fin_flag_mask="False" id="tcp-IRC" name="irc" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="port range" dst_range_end="11000" dst_range_start="10000" fin_flag="False" fin_flag_mask="False" id="id3B20468D" name="test-TCP" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="3128" dst_range_start="3128" fin_flag="False" fin_flag_mask="False" id="id3B5009F7" name="squid" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="True" ack_flag_mask="True" comment="" dst_range_end="0" dst_range_start="0" fin_flag="True" fin_flag_mask="True" id="id3B58E3F1" name="xmas-tree" psh_flag="False" psh_flag_mask="True" rst_flag="True" rst_flag_mask="True" src_range_end="0" src_range_start="0" syn_flag="True" syn_flag_mask="True" urg_flag="False" urg_flag_mask="True"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="70" dst_range_start="70" fin_flag="False" fin_flag_mask="False" id="id3C1A66EF" name="gopher" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="1080" dst_range_start="1080" fin_flag="False" fin_flag_mask="False" id="id3E59AD29" name="tcp-1080" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
+        <TCPService id="tcp-IRC" name="irc" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="6667" dst_range_end="6667"/>
+        <TCPService id="id3B20468D" name="test-TCP" comment="port range" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="10000" dst_range_end="11000"/>
+        <TCPService id="id3B5009F7" name="squid" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="3128" dst_range_end="3128"/>
+        <TCPService id="id3B58E3F1" name="xmas-tree" ack_flag="True" ack_flag_mask="True" fin_flag="True" fin_flag_mask="True" psh_flag="False" psh_flag_mask="True" rst_flag="True" rst_flag_mask="True" syn_flag="True" syn_flag_mask="True" urg_flag="False" urg_flag_mask="True" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
+        <TCPService id="id3C1A66EF" name="gopher" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="70" dst_range_end="70"/>
+        <TCPService id="id3E59AD29" name="tcp-1080" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="1080" dst_range_end="1080"/>
       </ServiceGroup>
       <ServiceGroup id="stdid08_1" name="UDP"/>
       <ServiceGroup id="stdid13_1" name="Custom">
-        <CustomService comment="Talk support" id="id3B64FE22" name="talk">
+        <CustomService id="id3B64FE22" name="talk" comment="Talk support">
           <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
           <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m ip_conntrack_talk -m ip_nat_talk</CustomServiceCommand>
         </CustomService>
-        <CustomService comment="" id="id41F9FFBA" name="natproto">
+        <CustomService id="id41F9FFBA" name="natproto">
           <CustomServiceCommand platform="ipf"></CustomServiceCommand>
           <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables"></CustomServiceCommand>
@@ -515,15 +622,15 @@
         </CustomService>
       </ServiceGroup>
       <ServiceGroup id="stdid05_1_userservices" name="Users">
-        <UserService comment="" id="id4849253820246" name="user2000" userid="2000"/>
-        <UserService comment="" id="id484A558E5896" name="user500" userid="500"/>
-        <UserService comment="" id="id484A6C525896" name="proxy" userid="proxy"/>
+        <UserService id="id4849253820246" name="user2000" userid="2000"/>
+        <UserService id="id484A558E5896" name="user500" userid="500"/>
+        <UserService id="id484A6C525896" name="proxy" userid="proxy"/>
       </ServiceGroup>
     </ServiceGroup>
     <ObjectGroup id="stdid12_1" name="Firewalls">
-      <Firewall comment="this is simple firewall with two interfaces. Test regular policy rules, including IP_fragments rule" host_OS="openbsd" id="fw-firewall2" inactive="False" lastCompiled="1157930800" lastInstalled="0" lastModified="1202682308" name="firewall" platform="pf" ro="False" version="">
+      <Firewall id="fw-firewall2" name="firewall" comment="this is simple firewall with two interfaces. Test regular policy rules, including IP_fragments rule" host_OS="openbsd" inactive="False" lastCompiled="1157930800" lastInstalled="0" lastModified="1202682308" platform="pf" ro="False" version="">
         <NAT id="nat-firewall2" name="NAT">
-          <NATRule comment="" disabled="False" id="nat-firewall2-0" position="0">
+          <NATRule id="nat-firewall2-0" disabled="False" position="0">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -544,7 +651,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule comment="illegal rule - host 'dyn host' has dynamic address" disabled="True" id="id3EE25AA2" position="1">
+          <NATRule id="id3EE25AA2" comment="illegal rule - host 'dyn host' has dynamic address" disabled="True" position="1">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -565,7 +672,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule comment="" disabled="False" id="nat-firewall2-1" position="2">
+          <NATRule id="nat-firewall2-1" disabled="False" position="2">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -586,7 +693,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id3CDB43B8" position="3">
+          <NATRule id="id3CDB43B8" disabled="False" position="3">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -609,7 +716,7 @@
           </NATRule>
         </NAT>
         <Policy id="pol-firewall2" name="Policy">
-          <PolicyRule action="Deny" direction="Inbound" disabled="False" id="id3B09D29D" log="True" position="0">
+          <PolicyRule id="id3B09D29D" action="Deny" direction="Inbound" disabled="False" log="True" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -626,7 +733,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" comment="Automatically generated rule blocking short fragments" direction="Inbound" disabled="False" id="pol-firewall2-0" log="True" position="1">
+          <PolicyRule id="pol-firewall2-0" comment="Automatically generated rule blocking short fragments" action="Deny" direction="Inbound" disabled="False" log="True" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -646,7 +753,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" comment="Automatically generated anti-spoofing rule" direction="Inbound" disabled="False" id="pol-firewall2-1" log="True" position="2">
+          <PolicyRule id="pol-firewall2-1" comment="Automatically generated anti-spoofing rule" action="Deny" direction="Inbound" disabled="False" log="True" position="2">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="fw-firewall2"/>
@@ -667,7 +774,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id3B92DFC5" log="False" position="3">
+          <PolicyRule id="id3B92DFC5" action="Accept" direction="Both" disabled="False" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -682,7 +789,7 @@
             </Itf>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Deny" comment="code should go into INPUT chain with &#10;address in destination for comparison" direction="Inbound" disabled="False" id="id3C4E4C38" log="True" position="4">
+          <PolicyRule id="id3C4E4C38" comment="code should go into INPUT chain with &#10;address in destination for comparison" action="Deny" direction="Inbound" disabled="False" log="True" position="4">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -699,7 +806,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" comment="" direction="Both" disabled="False" id="id3CE59C76" log="True" position="5">
+          <PolicyRule id="id3CE59C76" action="Deny" direction="Both" disabled="False" log="True" position="5">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -724,7 +831,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Both" disabled="False" id="id3B6659FC" log="True" position="6">
+          <PolicyRule id="id3B6659FC" action="Deny" direction="Both" disabled="False" log="True" position="6">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -746,7 +853,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="True" id="id3BF1B45E" log="False" position="7">
+          <PolicyRule id="id3BF1B45E" action="Accept" direction="Both" disabled="True" log="False" position="7">
             <Src neg="False">
               <ObjectRef ref="id3BF1B3E1"/>
             </Src>
@@ -769,7 +876,7 @@
               <Option name="log_prefix"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="True" id="id3BF1B44E" log="False" position="8">
+          <PolicyRule id="id3BF1B44E" action="Accept" direction="Both" disabled="True" log="False" position="8">
             <Src neg="False">
               <ObjectRef ref="id3BF1B3E7"/>
             </Src>
@@ -792,7 +899,7 @@
               <Option name="log_prefix"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="this rule is limited to 4 simultaneous&#10;connections by rule options" direction="Both" disabled="False" id="pol-firewall2-3" log="False" position="9">
+          <PolicyRule id="pol-firewall2-3" comment="this rule is limited to 4 simultaneous&#10;connections by rule options" action="Accept" direction="Both" disabled="False" log="False" position="9">
             <Src neg="False">
               <ObjectRef ref="host-secondary1-com"/>
               <ObjectRef ref="host-secondary2-com"/>
@@ -820,7 +927,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id4250E683" log="False" position="10">
+          <PolicyRule id="id4250E683" action="Accept" direction="Both" disabled="False" log="False" position="10">
             <Src neg="False">
               <ObjectRef ref="id3B665643"/>
             </Src>
@@ -849,7 +956,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="pol-firewall2-2" log="False" position="11">
+          <PolicyRule id="pol-firewall2-2" action="Accept" direction="Both" disabled="False" log="False" position="11">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -886,7 +993,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id3CD8770E" log="False" position="12">
+          <PolicyRule id="id3CD8770E" action="Accept" direction="Both" disabled="False" log="False" position="12">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -915,7 +1022,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="testing rule shading - this rule is exactly &#10;the same as pervious one, but uses group &#10;instead of address range" direction="Both" disabled="True" id="id3CD87B1E" log="False" position="13">
+          <PolicyRule id="id3CD87B1E" comment="testing rule shading - this rule is exactly &#10;the same as pervious one, but uses group &#10;instead of address range" action="Accept" direction="Both" disabled="True" log="False" position="13">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -939,7 +1046,7 @@
               <Option name="log_prefix"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="pol-firewall2-4" log="False" position="14">
+          <PolicyRule id="pol-firewall2-4" action="Accept" direction="Both" disabled="False" log="False" position="14">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -963,7 +1070,7 @@
               <Option name="log_prefix"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="this rule and the next one can be&#10;used to test shading" direction="Both" disabled="True" id="id3CE597E3" log="False" position="15">
+          <PolicyRule id="id3CE597E3" comment="this rule and the next one can be&#10;used to test shading" action="Accept" direction="Both" disabled="True" log="False" position="15">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -986,7 +1093,7 @@
               <Option name="log_prefix"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id3CE591F6" log="False" position="16">
+          <PolicyRule id="id3CE591F6" action="Accept" direction="Both" disabled="False" log="False" position="16">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1009,7 +1116,7 @@
               <Option name="log_prefix"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="illegal rule - object firewall8 has&#10;dynamic interface" direction="Both" disabled="True" id="id3EE2579E" log="False" position="17">
+          <PolicyRule id="id3EE2579E" comment="illegal rule - object firewall8 has&#10;dynamic interface" action="Accept" direction="Both" disabled="True" log="False" position="17">
             <Src neg="False">
               <ObjectRef ref="fw-firewall2"/>
               <ObjectRef ref="id3D581152"/>
@@ -1029,7 +1136,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="Automatically generated 'masquerading' rule" direction="Both" disabled="False" id="pol-firewall2-5" log="False" position="18">
+          <PolicyRule id="pol-firewall2-5" comment="Automatically generated 'masquerading' rule" action="Accept" direction="Both" disabled="False" log="False" position="18">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="fw-firewall2"/>
@@ -1053,7 +1160,7 @@
               <Option name="log_prefix"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" comment="Automatically generated 'catch all' rule" direction="Both" disabled="False" id="pol-firewall2-7" log="True" position="19">
+          <PolicyRule id="pol-firewall2-7" comment="Automatically generated 'catch all' rule" action="Deny" direction="Both" disabled="False" log="True" position="19">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1080,14 +1187,14 @@
           </PolicyRule>
         </Policy>
         <Routing id="fw-firewall2-routing" name="Routing"/>
-        <Interface bridgeport="False" dyn="False" id="if-FW-firewall2-eth1" name="eth1" security_level="0" unnum="False" unprotected="False">
+        <Interface id="if-FW-firewall2-eth1" name="eth1" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
           <IPv4 id="if-FW-firewall2-eth1-ipv4" name="address" address="222.222.222.222" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" dyn="False" id="if-FW-firewall2-eth0" name="eth0" security_level="100" unnum="False" unprotected="False">
+        <Interface id="if-FW-firewall2-eth0" name="eth0" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="if-FW-firewall2-eth0-ipv4" name="address" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" comment="" dyn="False" id="id3E5F1D39" label="" mgmt="False" name="lo" security_level="0" unnum="False" unprotected="False">
-          <IPv4 comment="" id="id3E5F1D3B" name="firewall:lo(ip)" address="127.0.0.1" netmask="255.0.0.0"/>
+        <Interface id="id3E5F1D39" name="lo" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id3E5F1D3B" name="firewall:lo(ip)" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
         <Management address="127.0.0.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -1215,9 +1322,9 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall comment="this object is used to test all kinds of negation in policy rules&#10;Also using interface policy on eth1 to test specific case with negation and&#10;rule shading depection&#10;" host_OS="openbsd" id="id3AF5AA0A" inactive="False" lastCompiled="1157930802" lastInstalled="0" lastModified="1200415171" name="firewall1" platform="pf" ro="False" version="">
+      <Firewall id="id3AF5AA0A" name="firewall1" comment="this object is used to test all kinds of negation in policy rules&#10;Also using interface policy on eth1 to test specific case with negation and&#10;rule shading depection&#10;" host_OS="openbsd" inactive="False" lastCompiled="1157930802" lastInstalled="0" lastModified="1200415171" platform="pf" ro="False" version="">
         <NAT id="id3AF5AA0D" name="NAT">
-          <NATRule disabled="False" id="id3C98491C" position="0">
+          <NATRule id="id3C98491C" disabled="False" position="0">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -1238,7 +1345,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id3AFADC09" position="1">
+          <NATRule id="id3AFADC09" disabled="False" position="1">
             <OSrc neg="False">
               <ObjectRef ref="host-hostA"/>
             </OSrc>
@@ -1259,7 +1366,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id3CD23959" position="2">
+          <NATRule id="id3CD23959" disabled="False" position="2">
             <OSrc neg="True">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -1280,7 +1387,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id3B1328FB" position="3">
+          <NATRule id="id3B1328FB" disabled="False" position="3">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -1301,7 +1408,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule comment="" disabled="False" id="id3E7ABBCD" position="4">
+          <NATRule id="id3E7ABBCD" disabled="False" position="4">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -1323,7 +1430,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule comment="more examples&#10;of NAT rules with&#10;multiple objects in TSrc&#10;in firewall3" disabled="False" id="id3E7ABFA4" position="5">
+          <NATRule id="id3E7ABFA4" comment="more examples&#10;of NAT rules with&#10;multiple objects in TSrc&#10;in firewall3" disabled="False" position="5">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -1345,7 +1452,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id3AF5AAD3" position="6">
+          <NATRule id="id3AF5AAD3" disabled="False" position="6">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -1366,7 +1473,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule comment="" disabled="False" id="id3CCA1B57" position="7">
+          <NATRule id="id3CCA1B57" disabled="False" position="7">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -1387,7 +1494,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id3B50F7CB" position="8">
+          <NATRule id="id3B50F7CB" disabled="False" position="8">
             <OSrc neg="True">
               <ObjectRef ref="id3B022266"/>
             </OSrc>
@@ -1408,7 +1515,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id3BD8D94B" position="9">
+          <NATRule id="id3BD8D94B" disabled="False" position="9">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -1429,7 +1536,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id3BD8D9DD" position="10">
+          <NATRule id="id3BD8D9DD" disabled="False" position="10">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -1450,7 +1557,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id3BBC0EA4" position="11">
+          <NATRule id="id3BBC0EA4" disabled="False" position="11">
             <OSrc neg="False">
               <ObjectRef ref="id3B4572AF"/>
             </OSrc>
@@ -1471,7 +1578,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id3BBC0F93" position="12">
+          <NATRule id="id3BBC0F93" disabled="False" position="12">
             <OSrc neg="True">
               <ObjectRef ref="id3B4572AF"/>
             </OSrc>
@@ -1492,7 +1599,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id3BC6BCE5" position="13">
+          <NATRule id="id3BC6BCE5" disabled="False" position="13">
             <OSrc neg="True">
               <ObjectRef ref="host-hostA"/>
             </OSrc>
@@ -1513,7 +1620,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id3FDCD893" position="14">
+          <NATRule id="id3FDCD893" disabled="False" position="14">
             <OSrc neg="False">
               <ObjectRef ref="id3B665643"/>
               <ObjectRef ref="id3FDCD983"/>
@@ -1537,7 +1644,7 @@
           </NATRule>
         </NAT>
         <Policy id="id3AF5AA0C" name="Policy">
-          <PolicyRule action="Deny" direction="Both" disabled="False" id="id3C5987DC" log="True" position="0">
+          <PolicyRule id="id3C5987DC" action="Deny" direction="Both" disabled="False" log="True" position="0">
             <Src neg="False">
               <ObjectRef ref="id3B4572B5"/>
             </Src>
@@ -1554,7 +1661,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Both" disabled="False" id="id3CD34BEF" log="False" position="1">
+          <PolicyRule id="id3CD34BEF" action="Deny" direction="Both" disabled="False" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="id3B4572AF"/>
             </Src>
@@ -1574,7 +1681,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" comment="Anti-spoofing rule" direction="Inbound" disabled="False" id="id3AF5AAB4" log="True" position="2">
+          <PolicyRule id="id3AF5AAB4" comment="Anti-spoofing rule" action="Deny" direction="Inbound" disabled="False" log="True" position="2">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3AF5AA0A"/>
@@ -1592,7 +1699,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" comment="Anti-spoofing rule" direction="Outbound" disabled="False" id="id3AF5AAAB" log="True" position="3">
+          <PolicyRule id="id3AF5AAAB" comment="Anti-spoofing rule" action="Deny" direction="Outbound" disabled="False" log="True" position="3">
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -1609,7 +1716,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="testing rule shading: this rule is not&#10;shaded by rule #1" direction="Inbound" disabled="False" id="id3D58886F" log="False" position="4">
+          <PolicyRule id="id3D58886F" comment="testing rule shading: this rule is not&#10;shaded by rule #1" action="Accept" direction="Inbound" disabled="False" log="False" position="4">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1627,7 +1734,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Deny" comment="" direction="Both" disabled="False" id="id3CCA26E4" log="True" position="5">
+          <PolicyRule id="id3CCA26E4" action="Deny" direction="Both" disabled="False" log="True" position="5">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1647,7 +1754,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Both" disabled="True" id="id3B9AB902" log="True" position="6">
+          <PolicyRule id="id3B9AB902" action="Deny" direction="Both" disabled="True" log="True" position="6">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1667,7 +1774,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="hostF has the same IP address as firewal." direction="Both" disabled="False" id="id3AFC0F90" log="True" position="7">
+          <PolicyRule id="id3AFC0F90" comment="hostF has the same IP address as firewal." action="Accept" direction="Both" disabled="False" log="True" position="7">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1685,7 +1792,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Deny" comment="testing negation in the policy rule" direction="Both" disabled="False" id="id4119961C" log="True" position="8">
+          <PolicyRule id="id4119961C" comment="testing negation in the policy rule" action="Deny" direction="Both" disabled="False" log="True" position="8">
             <Src neg="True">
               <ObjectRef ref="host-hostA"/>
             </Src>
@@ -1709,7 +1816,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" comment="testing negation in the policy rule" direction="Both" disabled="False" id="id3B021E10" log="True" position="9">
+          <PolicyRule id="id3B021E10" comment="testing negation in the policy rule" action="Deny" direction="Both" disabled="False" log="True" position="9">
             <Src neg="True">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
@@ -1734,7 +1841,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" comment="this rule is shaded by rule above." direction="Both" disabled="False" id="id3B0B4A13" log="True" position="10">
+          <PolicyRule id="id3B0B4A13" comment="this rule is shaded by rule above." action="Deny" direction="Both" disabled="False" log="True" position="10">
             <Src neg="True">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
@@ -1755,7 +1862,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" comment="this rule shades rule below" direction="Both" disabled="False" id="id3B5535B7" log="True" position="11">
+          <PolicyRule id="id3B5535B7" comment="this rule shades rule below" action="Deny" direction="Both" disabled="False" log="True" position="11">
             <Src neg="True">
               <ObjectRef ref="id3B022266"/>
               <ObjectRef ref="id3AF5AA0A"/>
@@ -1776,7 +1883,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Both" disabled="False" id="id3B11F63D" log="True" position="12">
+          <PolicyRule id="id3B11F63D" action="Deny" direction="Both" disabled="False" log="True" position="12">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
@@ -1798,7 +1905,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Reject" comment="testing negation in the policy rule" direction="Both" disabled="False" id="id41199643" log="True" position="13">
+          <PolicyRule id="id41199643" comment="testing negation in the policy rule" action="Reject" direction="Both" disabled="False" log="True" position="13">
             <Src neg="False">
               <ObjectRef ref="host-hostA"/>
             </Src>
@@ -1822,7 +1929,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" comment="testing negation in service field" direction="Both" disabled="True" id="id3B021E6F" log="True" position="14">
+          <PolicyRule id="id3B021E6F" comment="testing negation in service field" action="Deny" direction="Both" disabled="True" log="True" position="14">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1844,7 +1951,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="testing negation in service field" direction="Both" disabled="True" id="id3CCA2CF4" log="True" position="15">
+          <PolicyRule id="id3CCA2CF4" comment="testing negation in service field" action="Accept" direction="Both" disabled="True" log="True" position="15">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1864,7 +1971,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Both" disabled="False" id="id3B45739A" log="True" position="16">
+          <PolicyRule id="id3B45739A" action="Deny" direction="Both" disabled="False" log="True" position="16">
             <Src neg="False">
               <ObjectRef ref="id3B4572B5"/>
             </Src>
@@ -1884,7 +1991,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="'masquerading' rule" direction="Both" disabled="False" id="id3AF5AAC8" log="False" position="17">
+          <PolicyRule id="id3AF5AAC8" comment="'masquerading' rule" action="Accept" direction="Both" disabled="False" log="False" position="17">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -1902,7 +2009,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Deny" comment="'catch all' rule" direction="Both" disabled="False" id="id3AF5AAE3" log="True" position="18">
+          <PolicyRule id="id3AF5AAE3" comment="'catch all' rule" action="Deny" direction="Both" disabled="False" log="True" position="18">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1924,19 +2031,19 @@
           </PolicyRule>
         </Policy>
         <Routing id="id3AF5AA0A-routing" name="Routing"/>
-        <Interface bridgeport="False" dyn="False" id="id3AF5AA96" name="eth0" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id3AF5AA96" name="eth0" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id3AF5AA96-ipv4" name="address" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" dyn="False" id="id3AF5AA99" name="eth1" security_level="0" unnum="False" unprotected="False">
+        <Interface id="id3AF5AA99" name="eth1" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
           <IPv4 id="id3AF5AA99-ipv4" name="address" address="22.22.22.22" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" dyn="False" id="id3B0B4BC8" name="eth2" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id3B0B4BC8" name="eth2" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id3B0B4BC8-ipv4" name="address" address="192.168.2.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" dyn="False" id="id3B0B4D35" name="lo" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id3B0B4D35" name="lo" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id3B0B4D35-ipv4" name="address" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
-        <Interface bridgeport="False" dyn="False" id="id3B11F434" name="eth3" security_level="0" unnum="False" unprotected="False">
+        <Interface id="id3B11F434" name="eth3" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
           <IPv4 id="id3B11F434-ipv4" name="address" address="22.22.23.23" netmask="255.255.255.0"/>
         </Interface>
         <Management address="22.22.23.23">
@@ -2062,9 +2169,9 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall comment="testing detection of empty groups" host_OS="openbsd" id="id3DE69291" inactive="False" lastCompiled="1157930804" lastInstalled="0" lastModified="1193632387" name="firewall13" platform="pf" ro="False" version="">
+      <Firewall id="id3DE69291" name="firewall13" comment="testing detection of empty groups" host_OS="openbsd" inactive="False" lastCompiled="1157930804" lastInstalled="0" lastModified="1193632387" platform="pf" ro="False" version="">
         <NAT id="id3DE69292" name="NAT">
-          <NATRule comment="" disabled="False" id="id3DE69752" position="0">
+          <NATRule id="id3DE69752" disabled="False" position="0">
             <OSrc neg="False">
               <ObjectRef ref="id3DE69469"/>
             </OSrc>
@@ -2085,7 +2192,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule comment="" disabled="False" id="id3DE697CD" position="1">
+          <NATRule id="id3DE697CD" disabled="False" position="1">
             <OSrc neg="False">
               <ObjectRef ref="id3DE69469"/>
               <ObjectRef ref="id3B19C5EB"/>
@@ -2107,7 +2214,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule comment="" disabled="False" id="id3DE69866" position="2">
+          <NATRule id="id3DE69866" disabled="False" position="2">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2130,7 +2237,7 @@
           </NATRule>
         </NAT>
         <Policy id="id3DE692BD" name="Policy">
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id3DE6946F" log="False" position="0">
+          <PolicyRule id="id3DE6946F" action="Accept" direction="Both" disabled="False" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="id3DE6946A"/>
               <ObjectRef ref="id3B19C5EB"/>
@@ -2149,7 +2256,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id3DE6947B" log="False" position="1">
+          <PolicyRule id="id3DE6947B" action="Accept" direction="Both" disabled="False" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -2167,7 +2274,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Both" disabled="False" id="id3DE69487" log="True" position="2">
+          <PolicyRule id="id3DE69487" action="Deny" direction="Both" disabled="False" log="True" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -2189,10 +2296,10 @@
           </PolicyRule>
         </Policy>
         <Routing id="id3DE69291-routing" name="Routing"/>
-        <Interface bridgeport="False" dyn="False" id="id3DE6935E" name="eth1" security_level="0" unnum="False" unprotected="False">
-          <IPv4 comment="" id="id3DE6935F" name="address" address="22.22.22.22" netmask="255.255.255.0"/>
+        <Interface id="id3DE6935E" name="eth1" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id3DE6935F" name="address" address="22.22.22.22" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" dyn="False" id="id3DE6937E" name="eth0" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id3DE6937E" name="eth0" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id3DE6937F" name="address" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
         <Management address="192.168.1.1">
@@ -2267,9 +2374,9 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall comment="this object has several interfaces and shows different rules for NAT. Also testing policy rule options " host_OS="openbsd" id="id3AFB66C6" inactive="False" lastCompiled="1157930805" lastInstalled="0" lastModified="1210452316" name="firewall2" platform="pf" ro="False" version="">
+      <Firewall id="id3AFB66C6" name="firewall2" comment="this object has several interfaces and shows different rules for NAT. Also testing policy rule options " host_OS="openbsd" inactive="False" lastCompiled="1157930805" lastInstalled="0" lastModified="1210452316" platform="pf" ro="False" version="">
         <NAT id="id3AFB66C7" name="NAT">
-          <NATRule disabled="False" id="id3AFB66C8" position="0">
+          <NATRule id="id3AFB66C8" disabled="False" position="0">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2293,7 +2400,7 @@
               <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule disabled="False" id="id3AFB66D6" position="1">
+          <NATRule id="id3AFB66D6" disabled="False" position="1">
             <OSrc neg="False">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="id3B4572AF"/>
@@ -2318,7 +2425,7 @@
               <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule disabled="False" id="id3CABE6DF" position="2">
+          <NATRule id="id3CABE6DF" disabled="False" position="2">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2342,7 +2449,7 @@
               <Option name="color">#C0BA44</Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule comment="" disabled="False" id="id40E9A827" position="3">
+          <NATRule id="id40E9A827" disabled="False" position="3">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2366,7 +2473,7 @@
               <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule comment="" disabled="False" id="id40E9A83B" position="4">
+          <NATRule id="id40E9A83B" disabled="False" position="4">
             <OSrc neg="False">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="id3B4572AF"/>
@@ -2391,7 +2498,7 @@
               <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule comment="" disabled="False" id="id40E9A850" position="5">
+          <NATRule id="id40E9A850" disabled="False" position="5">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2415,7 +2522,7 @@
               <Option name="color">#C0BA44</Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule comment="" disabled="False" id="id40E9A8DE" position="6">
+          <NATRule id="id40E9A8DE" disabled="False" position="6">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2439,7 +2546,7 @@
               <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule comment="" disabled="False" id="id40E9A8F2" position="7">
+          <NATRule id="id40E9A8F2" disabled="False" position="7">
             <OSrc neg="False">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="id3B4572AF"/>
@@ -2464,7 +2571,7 @@
               <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule comment="" disabled="False" id="id40E9A907" position="8">
+          <NATRule id="id40E9A907" disabled="False" position="8">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2488,7 +2595,7 @@
               <Option name="color">#C0BA44</Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule comment="" disabled="False" id="id431BEFED" position="9">
+          <NATRule id="id431BEFED" disabled="False" position="9">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2509,7 +2616,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id3AFB69BD" position="10">
+          <NATRule id="id3AFB69BD" disabled="False" position="10">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2531,7 +2638,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id3BEEF6D2" position="11">
+          <NATRule id="id3BEEF6D2" disabled="False" position="11">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2552,7 +2659,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id3BD67563" position="12">
+          <NATRule id="id3BD67563" disabled="False" position="12">
             <OSrc neg="False">
               <ObjectRef ref="host-hostB"/>
             </OSrc>
@@ -2575,7 +2682,7 @@
               <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule disabled="True" id="id3BD6757E" position="13">
+          <NATRule id="id3BD6757E" disabled="True" position="13">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2596,7 +2703,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule comment="NETMAP " disabled="True" id="id3B66568B" position="14">
+          <NATRule id="id3B66568B" comment="NETMAP " disabled="True" position="14">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2617,7 +2724,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule comment="NETMAP" disabled="True" id="id3B6656EF" position="15">
+          <NATRule id="id3B6656EF" comment="NETMAP" disabled="True" position="15">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2638,7 +2745,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule comment="" disabled="False" id="id431C0728" position="16">
+          <NATRule id="id431C0728" disabled="False" position="16">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2659,7 +2766,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule comment="" disabled="False" id="id431C0714" position="17">
+          <NATRule id="id431C0714" disabled="False" position="17">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2680,7 +2787,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule comment="" disabled="False" id="id431C0700" position="18">
+          <NATRule id="id431C0700" disabled="False" position="18">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2701,7 +2808,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule comment="" disabled="False" id="id431C355F" position="19">
+          <NATRule id="id431C355F" disabled="False" position="19">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2722,7 +2829,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id3AFB69F7" position="20">
+          <NATRule id="id3AFB69F7" disabled="False" position="20">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2743,7 +2850,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule comment="" disabled="False" id="id414BEA12" position="21">
+          <NATRule id="id414BEA12" disabled="False" position="21">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2764,7 +2871,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule comment="" disabled="False" id="id414BEC22" position="22">
+          <NATRule id="id414BEC22" disabled="False" position="22">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2785,7 +2892,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id3B7313C4" position="23">
+          <NATRule id="id3B7313C4" disabled="False" position="23">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2806,7 +2913,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule comment="" disabled="False" id="id3E59ADF3" position="24">
+          <NATRule id="id3E59ADF3" disabled="False" position="24">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2827,7 +2934,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule comment="" disabled="False" id="id40ECF000" position="25">
+          <NATRule id="id40ECF000" disabled="False" position="25">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2848,7 +2955,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id3E59AC6D" position="26">
+          <NATRule id="id3E59AC6D" disabled="False" position="26">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2869,7 +2976,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id41F9FFBB" position="27">
+          <NATRule id="id41F9FFBB" disabled="False" position="27">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2890,7 +2997,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule comment="" disabled="False" id="id41FA0A82" position="28">
+          <NATRule id="id41FA0A82" disabled="False" position="28">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2916,7 +3023,7 @@
           </NATRule>
         </NAT>
         <Policy id="id3AFB66E4" name="Policy">
-          <PolicyRule action="Deny" direction="Inbound" disabled="False" id="id41451D62" log="True" position="0">
+          <PolicyRule id="id41451D62" action="Deny" direction="Inbound" disabled="False" log="True" position="0">
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -2936,7 +3043,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" comment="Anti-spoofing rule" direction="Inbound" disabled="False" id="id3AFB6708" log="True" position="1">
+          <PolicyRule id="id3AFB6708" comment="Anti-spoofing rule" action="Deny" direction="Inbound" disabled="False" log="True" position="1">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3AFB66C6"/>
@@ -2958,7 +3065,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" comment="rules 2,3,4 test group&#10;usage in interface&#10;all three rules should yield&#10;the same config" direction="Inbound" disabled="False" id="id465385F321432" log="True" position="2">
+          <PolicyRule id="id465385F321432" comment="rules 2,3,4 test group&#10;usage in interface&#10;all three rules should yield&#10;the same config" action="Deny" direction="Inbound" disabled="False" log="True" position="2">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3AFB66C6"/>
@@ -2983,7 +3090,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" comment="Anti-spoofing rule" direction="Inbound" disabled="False" id="id4653B74421432" log="True" position="3">
+          <PolicyRule id="id4653B74421432" comment="Anti-spoofing rule" action="Deny" direction="Inbound" disabled="False" log="True" position="3">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3AFB66C6"/>
@@ -3009,7 +3116,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" comment="Anti-spoofing rule" direction="Inbound" disabled="False" id="id4653860421432" log="True" position="4">
+          <PolicyRule id="id4653860421432" comment="Anti-spoofing rule" action="Deny" direction="Inbound" disabled="False" log="True" position="4">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3AFB66C6"/>
@@ -3035,7 +3142,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" comment="Anti-spoofing rule" direction="Outbound" disabled="False" id="id3AFB6710" log="True" position="5">
+          <PolicyRule id="id3AFB6710" comment="Anti-spoofing rule" action="Deny" direction="Outbound" disabled="False" log="True" position="5">
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3AFB66C6"/>
@@ -3057,7 +3164,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" comment="block fragments" direction="Both" disabled="False" id="id3AFB66E5" log="True" position="6">
+          <PolicyRule id="id3AFB66E5" comment="block fragments" action="Deny" direction="Both" disabled="False" log="True" position="6">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3078,7 +3185,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Reject" comment="sends TCP RST and makes custom record in the log" direction="Both" disabled="False" id="id3B0C6FD2" log="True" position="7">
+          <PolicyRule id="id3B0C6FD2" comment="sends TCP RST and makes custom record in the log" action="Reject" direction="Both" disabled="False" log="True" position="7">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3102,7 +3209,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id3D8FEDA9" log="False" position="8">
+          <PolicyRule id="id3D8FEDA9" action="Accept" direction="Both" disabled="False" log="False" position="8">
             <Src neg="False">
               <ObjectRef ref="id3B4572AF"/>
               <ObjectRef ref="id3D8FED30"/>
@@ -3121,7 +3228,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id3D8FEE11" log="False" position="9">
+          <PolicyRule id="id3D8FEE11" action="Accept" direction="Both" disabled="False" log="False" position="9">
             <Src neg="False">
               <ObjectRef ref="id3B19C5EB"/>
             </Src>
@@ -3140,7 +3247,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="'masquerading' rule" direction="Both" disabled="False" id="id3AFB66EF" log="False" position="10">
+          <PolicyRule id="id3AFB66EF" comment="'masquerading' rule" action="Accept" direction="Both" disabled="False" log="False" position="10">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -3160,7 +3267,7 @@
               <Option name="id"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="host-fw2 has the same address as &#10;        one of the firewall's interfaces" direction="Both" disabled="True" id="id3C447B8D" log="True" position="11">
+          <PolicyRule id="id3C447B8D" comment="host-fw2 has the same address as &#10;        one of the firewall's interfaces" action="Accept" direction="Both" disabled="True" log="True" position="11">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3178,7 +3285,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id3C447BCB" log="False" position="12">
+          <PolicyRule id="id3C447BCB" action="Accept" direction="Both" disabled="False" log="False" position="12">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3199,7 +3306,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Deny" comment="'catch all' rule" direction="Both" disabled="False" id="id3AFB66F9" log="True" position="13">
+          <PolicyRule id="id3AFB66F9" comment="'catch all' rule" action="Deny" direction="Both" disabled="False" log="True" position="13">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3222,20 +3329,20 @@
           </PolicyRule>
         </Policy>
         <Routing id="id3AFB66C6-routing" name="Routing"/>
-        <Interface bridgeport="False" dyn="False" id="id3AFB6703" name="eth0" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id3AFB6703" name="eth0" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id3AFB6703-ipv4" name="address" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" dyn="False" id="id3AFB6706" name="eth1" security_level="0" unnum="False" unprotected="False">
+        <Interface id="id3AFB6706" name="eth1" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
           <IPv4 id="id3AFB6706-ipv4" name="address" address="22.22.22.22" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" dyn="False" id="id3AFB68D2" name="eth3" security_level="0" unnum="False" unprotected="False">
+        <Interface id="id3AFB68D2" name="eth3" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
           <IPv4 id="id3AFB68D2-ipv4" name="address" address="22.22.23.23" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" comment="" dyn="False" id="id3B0221F1" label="" mgmt="True" name="eth2" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id3B0221F1" name="eth2" bridgeport="False" dyn="False" label="" mgmt="True" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id3B0221F1-ipv4" name="address" address="192.168.2.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" dyn="False" id="id3CD2449F" label="" name="lo" security_level="100" unnum="False" unprotected="False">
-          <IPv4 comment="" id="id3CD2449F-ipv4" name="lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
+        <Interface id="id3CD2449F" name="lo" bridgeport="False" dyn="False" label="" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id3CD2449F-ipv4" name="lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
         <Management address="192.168.2.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -3369,9 +3476,9 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall comment="this object is used to test a configuration where firewall has dynamic address " host_OS="openbsd" id="id3B0C6380" inactive="False" lastCompiled="1157930815" lastInstalled="0" lastModified="1200415196" name="firewall4" platform="pf" ro="False" version="">
+      <Firewall id="id3B0C6380" name="firewall4" comment="this object is used to test a configuration where firewall has dynamic address " host_OS="openbsd" inactive="False" lastCompiled="1157930815" lastInstalled="0" lastModified="1200415196" platform="pf" ro="False" version="">
         <NAT id="id3B0C6381" name="NAT">
-          <NATRule disabled="False" id="id3B0C6382" position="0">
+          <NATRule id="id3B0C6382" disabled="False" position="0">
             <OSrc neg="False">
               <ObjectRef ref="host-hostA"/>
             </OSrc>
@@ -3394,7 +3501,7 @@
               <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule disabled="False" id="id3B0C6390" position="1">
+          <NATRule id="id3B0C6390" disabled="False" position="1">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -3417,7 +3524,7 @@
               <Option name="id"></Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule disabled="False" id="id3B202AFF" position="2">
+          <NATRule id="id3B202AFF" disabled="False" position="2">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -3438,7 +3545,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule comment="SDNAT rule&#10;" disabled="False" id="id3E797EFF" position="3">
+          <NATRule id="id3E797EFF" comment="SDNAT rule&#10;" disabled="False" position="3">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -3461,7 +3568,7 @@
           </NATRule>
         </NAT>
         <Policy id="id3B0C639E" name="Policy">
-          <PolicyRule action="Deny" direction="Both" disabled="False" id="id3B54F071" log="True" position="0">
+          <PolicyRule id="id3B54F071" action="Deny" direction="Both" disabled="False" log="True" position="0">
             <Src neg="True">
               <ObjectRef ref="id3B022266"/>
             </Src>
@@ -3478,7 +3585,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" comment="Anti-spoofing rule" direction="Inbound" disabled="False" id="id3B0C63E3" log="True" position="1">
+          <PolicyRule id="id3B0C63E3" comment="Anti-spoofing rule" action="Deny" direction="Inbound" disabled="False" log="True" position="1">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B0C6380"/>
@@ -3496,7 +3603,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" comment="Anti-spoofing rule" direction="Outbound" disabled="False" id="id3B0C63EB" log="True" position="2">
+          <PolicyRule id="id3B0C63EB" comment="Anti-spoofing rule" action="Deny" direction="Outbound" disabled="False" log="True" position="2">
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B0C6380"/>
@@ -3514,7 +3621,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="hostF has the same IP address as firewal." direction="Both" disabled="False" id="id3B0C639F" log="True" position="3">
+          <PolicyRule id="id3B0C639F" comment="hostF has the same IP address as firewal." action="Accept" direction="Both" disabled="False" log="True" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3534,7 +3641,7 @@
               <Option name="id"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" comment="" direction="Both" disabled="False" id="id3B0C63B4" log="True" position="4">
+          <PolicyRule id="id3B0C63B4" action="Deny" direction="Both" disabled="False" log="True" position="4">
             <Src neg="True">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
@@ -3556,7 +3663,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" comment="testing negation in the policy rule" direction="Both" disabled="False" id="id3B0C63A9" log="True" position="5">
+          <PolicyRule id="id3B0C63A9" comment="testing negation in the policy rule" action="Deny" direction="Both" disabled="False" log="True" position="5">
             <Src neg="True">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
@@ -3578,7 +3685,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" comment="testing negation in service field" direction="Both" disabled="True" id="id3B0C63BF" log="True" position="6">
+          <PolicyRule id="id3B0C63BF" comment="testing negation in service field" action="Deny" direction="Both" disabled="True" log="True" position="6">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3601,7 +3708,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="'masquerading' rule" direction="Both" disabled="False" id="id3B0C63CB" log="False" position="7">
+          <PolicyRule id="id3B0C63CB" comment="'masquerading' rule" action="Accept" direction="Both" disabled="False" log="False" position="7">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -3621,7 +3728,7 @@
               <Option name="id"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" comment="'catch all' rule" direction="Both" disabled="False" id="id3B0C63D5" log="True" position="8">
+          <PolicyRule id="id3B0C63D5" comment="'catch all' rule" action="Deny" direction="Both" disabled="False" log="True" position="8">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3644,19 +3751,19 @@
           </PolicyRule>
         </Policy>
         <Routing id="id3B0C6380-routing" name="Routing"/>
-        <Interface bridgeport="False" dyn="False" id="id3B0C63DF" name="eth0" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id3B0C63DF" name="eth0" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id3B0C63DF-ipv4" name="address" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" dyn="True" id="id3B0C63E1" label="" name="eth1" security_level="0" unnum="False" unprotected="False">
+        <Interface id="id3B0C63E1" name="eth1" bridgeport="False" dyn="True" label="" security_level="0" unnum="False" unprotected="False">
           <IPv4 id="id3B0C63E1-ipv4" name="address" address="0.0.0.0" netmask="0.0.0.0"/>
         </Interface>
-        <Interface bridgeport="False" dyn="False" id="id3B0C63F3" name="eth2" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id3B0C63F3" name="eth2" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id3B0C63F3-ipv4" name="address" address="192.168.2.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" dyn="False" id="id3B0C63F5" name="lo" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id3B0C63F5" name="lo" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id3B0C63F5-ipv4" name="address" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
-        <Interface bridgeport="False" dyn="False" id="id3CD88A77" label="" name="eth3" security_level="0" unnum="False" unprotected="False">
+        <Interface id="id3CD88A77" name="eth3" bridgeport="False" dyn="False" label="" security_level="0" unnum="False" unprotected="False">
           <IPv4 id="id3CD88A77-ipv4" name="address" address="222.222.222.222" netmask="255.255.255.0"/>
         </Interface>
         <Management address="222.222.222.222">
@@ -3777,9 +3884,9 @@
           <Option name="use_tables">False</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall comment="testing IP fragments and scrub" host_OS="openbsd" id="id3E1FC43C" inactive="False" lastCompiled="1157930819" lastInstalled="0" lastModified="1200415199" name="firewall5" platform="pf" ro="False" version="">
+      <Firewall id="id3E1FC43C" name="firewall5" comment="testing IP fragments and scrub" host_OS="openbsd" inactive="False" lastCompiled="1157930819" lastInstalled="0" lastModified="1200415199" platform="pf" ro="False" version="">
         <NAT id="id3E1FC43D" name="NAT">
-          <NATRule disabled="True" id="id3E1FC8FC" position="0">
+          <NATRule id="id3E1FC8FC" disabled="True" position="0">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -3802,7 +3909,7 @@
           </NATRule>
         </NAT>
         <Policy id="id3E1FC469" name="Policy">
-          <PolicyRule action="Deny" comment="" direction="Both" disabled="False" id="id3E1FC62E" log="True" position="0">
+          <PolicyRule id="id3E1FC62E" action="Deny" direction="Both" disabled="False" log="True" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3827,7 +3934,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" comment="" direction="Both" disabled="False" id="id3E1FC7B6" log="True" position="1">
+          <PolicyRule id="id3E1FC7B6" action="Deny" direction="Both" disabled="False" log="True" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3852,7 +3959,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Both" disabled="False" id="id3E1FC47F" log="True" position="2">
+          <PolicyRule id="id3E1FC47F" action="Deny" direction="Both" disabled="False" log="True" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3874,14 +3981,14 @@
           </PolicyRule>
         </Policy>
         <Routing id="id3E1FC43C-routing" name="Routing"/>
-        <Interface bridgeport="False" dyn="False" id="id3E1FC489" name="eth1" security_level="0" unnum="False" unprotected="False">
-          <IPv4 comment="" id="id3E1FC48A" name="address" address="22.22.22.22" netmask="255.255.255.0"/>
+        <Interface id="id3E1FC489" name="eth1" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id3E1FC48A" name="address" address="22.22.22.22" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" dyn="False" id="id3E1FC48C" name="eth0" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id3E1FC48C" name="eth0" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id3E1FC48D" name="address" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" comment="" dyn="False" id="id3E5F1D4C" label="" mgmt="False" name="lo" security_level="0" unnum="False" unprotected="False">
-          <IPv4 comment="" id="id3E5F1D4E" name="firewall5:lo(ip)" address="127.0.0.1" netmask="255.0.0.0"/>
+        <Interface id="id3E5F1D4C" name="lo" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id3E5F1D4E" name="firewall5:lo(ip)" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
         <Management address="127.0.0.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -3958,10 +4065,10 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall comment="testing rule with firewall in dst and negation" host_OS="openbsd" id="id3C698F1D" inactive="False" lastCompiled="1157930821" lastInstalled="0" lastModified="1200415203" name="firewall6" platform="pf" ro="False" version="">
+      <Firewall id="id3C698F1D" name="firewall6" comment="testing rule with firewall in dst and negation" host_OS="openbsd" inactive="False" lastCompiled="1157930821" lastInstalled="0" lastModified="1200415203" platform="pf" ro="False" version="">
         <NAT id="id3C698F1E" name="NAT"/>
         <Policy id="id3C698F9D" name="Policy">
-          <PolicyRule action="Deny" comment="" direction="Inbound" disabled="False" id="id3C699028" log="True" position="0">
+          <PolicyRule id="id3C699028" action="Deny" direction="Inbound" disabled="False" log="True" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -3978,7 +4085,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Both" disabled="False" id="id3C698FB2" log="False" position="1">
+          <PolicyRule id="id3C698FB2" action="Deny" direction="Both" disabled="False" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4000,19 +4107,19 @@
           </PolicyRule>
         </Policy>
         <Routing id="id3C698F1D-routing" name="Routing"/>
-        <Interface bridgeport="False" dyn="False" id="id3C699013" name="eth0" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id3C699013" name="eth0" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id3C699013-ipv4" name="address" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" dyn="False" id="id3C69901D" name="eth1" security_level="0" unnum="False" unprotected="False">
+        <Interface id="id3C69901D" name="eth1" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
           <IPv4 id="id3C69901D-ipv4" name="address" address="22.22.22.22" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" dyn="False" id="id3C699030" name="eth2" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id3C699030" name="eth2" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id3C699030-ipv4" name="address" address="192.168.2.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" dyn="False" id="id3C699032" name="lo" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id3C699032" name="lo" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id3C699032-ipv4" name="address" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
-        <Interface bridgeport="False" dyn="False" id="id3C699034" name="eth3" security_level="0" unnum="False" unprotected="False">
+        <Interface id="id3C699034" name="eth3" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
           <IPv4 id="id3C699034-ipv4" name="address" address="22.22.23.23" netmask="255.255.255.0"/>
         </Interface>
         <Management address="22.22.23.23">
@@ -4085,10 +4192,10 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall comment="testing rules with broadcasts" host_OS="openbsd" id="id3C69BD4F" inactive="False" lastCompiled="1157930822" lastInstalled="0" lastModified="1200415209" name="firewall7" platform="pf" ro="False" version="">
+      <Firewall id="id3C69BD4F" name="firewall7" comment="testing rules with broadcasts" host_OS="openbsd" inactive="False" lastCompiled="1157930822" lastInstalled="0" lastModified="1200415209" platform="pf" ro="False" version="">
         <NAT id="id3C69BD50" name="NAT"/>
         <Policy id="id3C69BD51" name="Policy">
-          <PolicyRule action="Deny" direction="Inbound" disabled="False" id="id3C69BDE1" log="True" position="0">
+          <PolicyRule id="id3C69BDE1" action="Deny" direction="Inbound" disabled="False" log="True" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4108,7 +4215,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id3C69BF13" log="False" position="1">
+          <PolicyRule id="id3C69BF13" action="Accept" direction="Both" disabled="False" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4128,19 +4235,19 @@
           </PolicyRule>
         </Policy>
         <Routing id="id3C69BD4F-routing" name="Routing"/>
-        <Interface bridgeport="False" dyn="False" id="id3C69BD5C" name="eth0" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id3C69BD5C" name="eth0" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id3C69BD5C-ipv4" name="address" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" dyn="False" id="id3C69BD5E" name="eth1" security_level="0" unnum="False" unprotected="False">
+        <Interface id="id3C69BD5E" name="eth1" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
           <IPv4 id="id3C69BD5E-ipv4" name="address" address="22.22.22.22" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" dyn="False" id="id3C69BD68" name="eth2" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id3C69BD68" name="eth2" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id3C69BD68-ipv4" name="address" address="192.168.2.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" dyn="False" id="id3C69BD6A" name="lo" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id3C69BD6A" name="lo" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id3C69BD6A-ipv4" name="address" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
-        <Interface bridgeport="False" dyn="False" id="id3C69BD6C" name="eth3" security_level="0" unnum="False" unprotected="False">
+        <Interface id="id3C69BD6C" name="eth3" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
           <IPv4 id="id3C69BD6C-ipv4" name="address" address="22.22.23.23" netmask="255.255.255.0"/>
         </Interface>
         <Management address="22.22.23.23">
@@ -4213,9 +4320,9 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall comment="" host_OS="openbsd" id="id3D581152" inactive="False" lastCompiled="1157930823" lastInstalled="0" lastModified="1200415211" name="firewall8" platform="pf" ro="False" version="">
+      <Firewall id="id3D581152" name="firewall8" host_OS="openbsd" inactive="False" lastCompiled="1157930823" lastInstalled="0" lastModified="1200415211" platform="pf" ro="False" version="">
         <NAT id="id3D581156" name="NAT">
-          <NATRule disabled="False" id="id3D58164E" position="0">
+          <NATRule id="id3D58164E" disabled="False" position="0">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -4236,7 +4343,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id3D58163D" position="1">
+          <NATRule id="id3D58163D" disabled="False" position="1">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -4257,7 +4364,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id3D5812BC" position="2">
+          <NATRule id="id3D5812BC" disabled="False" position="2">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -4278,7 +4385,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id3D581322" position="3">
+          <NATRule id="id3D581322" disabled="False" position="3">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4299,7 +4406,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id3D5812AE" position="4">
+          <NATRule id="id3D5812AE" disabled="False" position="4">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4320,7 +4427,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id3D5812CC" position="5">
+          <NATRule id="id3D5812CC" disabled="False" position="5">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4341,7 +4448,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule comment="" disabled="False" id="id3D5812FA" position="6">
+          <NATRule id="id3D5812FA" disabled="False" position="6">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4362,7 +4469,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule comment="" disabled="False" id="id3D58130E" position="7">
+          <NATRule id="id3D58130E" disabled="False" position="7">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4383,7 +4490,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id40ECF00B" position="8">
+          <NATRule id="id40ECF00B" disabled="False" position="8">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -4406,7 +4513,7 @@
           </NATRule>
         </NAT>
         <Policy id="id3D581155" name="Policy">
-          <PolicyRule action="Accounting" direction="Both" disabled="False" id="id3E5F239B" log="False" position="0">
+          <PolicyRule id="id3E5F239B" action="Accounting" direction="Both" disabled="False" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4426,7 +4533,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accounting" direction="Both" disabled="False" id="id3E5F2391" log="True" position="1">
+          <PolicyRule id="id3E5F2391" action="Accounting" direction="Both" disabled="False" log="True" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4446,7 +4553,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id3D5811A5" log="False" position="2">
+          <PolicyRule id="id3D5811A5" action="Accept" direction="Both" disabled="False" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4464,7 +4571,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id3D58119B" log="False" position="3">
+          <PolicyRule id="id3D58119B" action="Accept" direction="Both" disabled="False" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4482,7 +4589,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id3D5811FB" log="False" position="4">
+          <PolicyRule id="id3D5811FB" action="Accept" direction="Both" disabled="False" log="False" position="4">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4500,7 +4607,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Both" disabled="False" id="id3D5811B1" log="True" position="5">
+          <PolicyRule id="id3D5811B1" action="Deny" direction="Both" disabled="False" log="True" position="5">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4522,17 +4629,17 @@
           </PolicyRule>
         </Policy>
         <Routing id="id3D581152-routing" name="Routing"/>
-        <Interface bridgeport="False" comment="" dyn="False" id="id3D58115B" label="" name="eth1" security_level="0" unnum="False" unprotected="False">
-          <IPv4 comment="" id="id3D58115D" name="firewall8:eth1:1" address="33.33.33.34" netmask="255.255.255.0"/>
-          <IPv4 comment="" id="id3D58115E" name="firewall8:eth1:0" address="33.33.33.33" netmask="255.255.255.0"/>
+        <Interface id="id3D58115B" name="eth1" bridgeport="False" dyn="False" label="" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id3D58115D" name="firewall8:eth1:1" address="33.33.33.34" netmask="255.255.255.0"/>
+          <IPv4 id="id3D58115E" name="firewall8:eth1:0" address="33.33.33.33" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" comment="" dyn="False" id="id3D581188" label="" name="eth0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 comment="" id="id3D58118A" name="firewall8:eth0" address="192.168.1.1" netmask="255.255.255.0"/>
+        <Interface id="id3D581188" name="eth0" bridgeport="False" dyn="False" label="" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id3D58118A" name="firewall8:eth0" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" comment="" dyn="False" id="id3E5F18E9" label="" mgmt="False" name="lo" security_level="100" unnum="False" unprotected="False">
-          <IPv4 comment="" id="id3E5F18EB" name="firewall8:lo(ip)" address="127.0.0.1" netmask="255.0.0.0"/>
+        <Interface id="id3E5F18E9" name="lo" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id3E5F18EB" name="firewall8:lo(ip)" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
-        <Interface bridgeport="False" comment="" dyn="True" id="id3EE256C2" label="" mgmt="False" name="ppp0" security_level="0" unnum="False" unprotected="False"/>
+        <Interface id="id3EE256C2" name="ppp0" bridgeport="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False"/>
         <Management address="0.0.0.0">
           <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
@@ -4575,9 +4682,9 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall comment="testing rules with broadcasts" host_OS="freebsd" id="id3E853CBE" inactive="False" lastCompiled="1157930825" lastInstalled="0" lastModified="1200415214" name="firewall9" platform="pf" ro="False" version="">
+      <Firewall id="id3E853CBE" name="firewall9" comment="testing rules with broadcasts" host_OS="freebsd" inactive="False" lastCompiled="1157930825" lastInstalled="0" lastModified="1200415214" platform="pf" ro="False" version="">
         <NAT id="id3E853CBF" name="NAT">
-          <NATRule disabled="True" id="id3E853EF8" position="0">
+          <NATRule id="id3E853EF8" disabled="True" position="0">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -4598,7 +4705,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id3E853F16" position="1">
+          <NATRule id="id3E853F16" disabled="False" position="1">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -4621,7 +4728,7 @@
           </NATRule>
         </NAT>
         <Policy id="id3E853CC0" name="Policy">
-          <PolicyRule action="Deny" direction="Inbound" disabled="False" id="id3E853CCE" log="True" position="0">
+          <PolicyRule id="id3E853CCE" action="Deny" direction="Inbound" disabled="False" log="True" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4641,7 +4748,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id3E853CEF" log="False" position="1">
+          <PolicyRule id="id3E853CEF" action="Accept" direction="Both" disabled="False" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4659,7 +4766,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="True" id="id3E853D1B" log="False" position="2">
+          <PolicyRule id="id3E853D1B" action="Accept" direction="Both" disabled="True" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="id3E853CD8"/>
             </Src>
@@ -4677,7 +4784,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id3E853CC1" log="False" position="3">
+          <PolicyRule id="id3E853CC1" action="Accept" direction="Both" disabled="False" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4695,7 +4802,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Both" disabled="False" id="id3E853D26" log="True" position="4">
+          <PolicyRule id="id3E853D26" action="Deny" direction="Both" disabled="False" log="True" position="4">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4717,11 +4824,11 @@
           </PolicyRule>
         </Policy>
         <Routing id="id3E853CBE-routing" name="Routing"/>
-        <Interface bridgeport="False" dyn="False" id="id3E853CCB" name="eth0" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id3E853CCB" name="eth0" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id3E853CCC" name="address" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" comment="" dyn="False" id="id3E853CD8" label="" mgmt="False" name="enc0" security_level="0" unnum="True" unprotected="False"/>
-        <Interface bridgeport="False" dyn="False" id="id3E853CDE" name="lo" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id3E853CD8" name="enc0" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="True" unprotected="False"/>
+        <Interface id="id3E853CDE" name="lo" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id3E853CDF" name="address" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
         <Management address="127.0.0.1">
@@ -4797,9 +4904,9 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall comment="testing DNSName object" host_OS="freebsd" id="id43867C1018346" inactive="False" lastCompiled="1157930808" lastInstalled="0" lastModified="1193632397" name="firewall33" platform="pf" ro="False" version="">
+      <Firewall id="id43867C1018346" name="firewall33" comment="testing DNSName object" host_OS="freebsd" inactive="False" lastCompiled="1157930808" lastInstalled="0" lastModified="1193632397" platform="pf" ro="False" version="">
         <NAT id="id43867C4818346" name="NAT">
-          <NATRule disabled="False" id="id43876E2618346" position="0">
+          <NATRule id="id43876E2618346" disabled="False" position="0">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4820,7 +4927,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule comment="" disabled="False" id="id43876E5218346" position="1">
+          <NATRule id="id43876E5218346" disabled="False" position="1">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4841,7 +4948,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id43876E6918346" position="2">
+          <NATRule id="id43876E6918346" disabled="False" position="2">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4863,7 +4970,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id43876E7B18346" position="3">
+          <NATRule id="id43876E7B18346" disabled="False" position="3">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4887,7 +4994,7 @@
           </NATRule>
         </NAT>
         <Policy id="id43867C1618346" name="Policy">
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id43867C2418346" log="False" position="0">
+          <PolicyRule id="id43867C2418346" action="Accept" direction="Both" disabled="False" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="id43869E8C18346"/>
             </Src>
@@ -4905,7 +5012,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id43869E9018346" log="False" position="1">
+          <PolicyRule id="id43869E9018346" action="Accept" direction="Both" disabled="False" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="id43869E8D18346"/>
             </Src>
@@ -4923,7 +5030,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id43869E9E18346" log="False" position="2">
+          <PolicyRule id="id43869E9E18346" action="Accept" direction="Both" disabled="False" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="id43869E8E18346"/>
             </Src>
@@ -4941,7 +5048,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id43869EAA18346" log="False" position="3">
+          <PolicyRule id="id43869EAA18346" action="Accept" direction="Both" disabled="False" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="id43869E8F18346"/>
             </Src>
@@ -4959,7 +5066,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Both" disabled="False" id="id4386E38318346" log="False" position="4">
+          <PolicyRule id="id4386E38318346" action="Deny" direction="Both" disabled="False" log="False" position="4">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4979,7 +5086,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Both" disabled="False" id="id4386E37718346" log="False" position="5">
+          <PolicyRule id="id4386E37718346" action="Deny" direction="Both" disabled="False" log="False" position="5">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -4999,7 +5106,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id43867C3018346" log="False" position="6">
+          <PolicyRule id="id43867C3018346" action="Accept" direction="Both" disabled="False" log="False" position="6">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5017,7 +5124,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id4386C10D18346" log="False" position="7">
+          <PolicyRule id="id4386C10D18346" action="Accept" direction="Both" disabled="False" log="False" position="7">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5035,7 +5142,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id438728A918346" log="False" position="8">
+          <PolicyRule id="id438728A918346" action="Accept" direction="Both" disabled="False" log="False" position="8">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5054,7 +5161,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id438728BA18346" log="False" position="9">
+          <PolicyRule id="id438728BA18346" action="Accept" direction="Both" disabled="False" log="False" position="9">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5073,7 +5180,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id438728CD18346" log="False" position="10">
+          <PolicyRule id="id438728CD18346" action="Accept" direction="Both" disabled="False" log="False" position="10">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5092,7 +5199,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Both" disabled="False" id="id43867C3C18346" log="True" position="11">
+          <PolicyRule id="id43867C3C18346" action="Deny" direction="Both" disabled="False" log="True" position="11">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5114,12 +5221,12 @@
           </PolicyRule>
         </Policy>
         <Routing id="id43867C5718346" name="Routing"/>
-        <Interface bridgeport="False" comment="VLAN interface" dyn="True" id="id43867C5818346" label="" mgmt="False" name="eth0.100" security_level="0" unnum="False" unprotected="False"/>
-        <Interface bridgeport="False" dyn="False" id="id43867C5918346" name="lo" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id43867C5818346" name="eth0.100" comment="VLAN interface" bridgeport="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False"/>
+        <Interface id="id43867C5918346" name="lo" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id43867C5B18346" name="firewall33:lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
-        <Interface bridgeport="False" comment="" dyn="False" id="id43867C5C18346" label="" mgmt="True" name="eth1" security_level="100" unnum="False" unprotected="False">
-          <IPv4 comment="" id="id43867C5E18346" name="firewall33:eth1:ip" address="192.168.1.100" netmask="255.255.255.0"/>
+        <Interface id="id43867C5C18346" name="eth1" bridgeport="False" dyn="False" label="" mgmt="True" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id43867C5E18346" name="firewall33:eth1:ip" address="192.168.1.100" netmask="255.255.255.0"/>
         </Interface>
         <Management address="192.168.1.100">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -5211,9 +5318,9 @@
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall comment="testing AddressTable object" host_OS="openbsd" id="id4389EDAE18346" inactive="False" lastCompiled="1210047001" lastInstalled="0" lastModified="1210046836" name="firewall34" platform="pf" ro="False" version="">
+      <Firewall id="id4389EDAE18346" name="firewall34" comment="testing AddressTable object" host_OS="openbsd" inactive="False" lastCompiled="1210047001" lastInstalled="0" lastModified="1210046836" platform="pf" ro="False" version="">
         <NAT id="id4389EE4818346" name="NAT">
-          <NATRule disabled="False" id="id4389EEB018346" position="0">
+          <NATRule id="id4389EEB018346" disabled="False" position="0">
             <OSrc neg="True">
               <ObjectRef ref="id4389EE9118346"/>
             </OSrc>
@@ -5234,7 +5341,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id446FDDE610619" position="1">
+          <NATRule id="id446FDDE610619" disabled="False" position="1">
             <OSrc neg="False">
               <ObjectRef ref="id4390C25525682"/>
             </OSrc>
@@ -5255,7 +5362,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id43891B6E674" position="2">
+          <NATRule id="id43891B6E674" disabled="False" position="2">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -5276,7 +5383,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id467A0FE823947" position="3">
+          <NATRule id="id467A0FE823947" disabled="False" position="3">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -5297,7 +5404,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule comment="" disabled="False" id="id467A0FF823947" position="4">
+          <NATRule id="id467A0FF823947" disabled="False" position="4">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -5318,7 +5425,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id467A209B23947" position="5">
+          <NATRule id="id467A209B23947" disabled="False" position="5">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -5339,7 +5446,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule comment="" disabled="False" id="id467A20AD23947" position="6">
+          <NATRule id="id467A20AD23947" disabled="False" position="6">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -5362,7 +5469,7 @@
           </NATRule>
         </NAT>
         <Policy id="id4389EDB418346" name="Policy">
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id4389EDB518346" log="False" position="0">
+          <PolicyRule id="id4389EDB518346" action="Accept" direction="Both" disabled="False" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5380,7 +5487,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Both" disabled="False" id="id4388CFEA674" log="True" position="1">
+          <PolicyRule id="id4388CFEA674" action="Deny" direction="Both" disabled="False" log="True" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5400,7 +5507,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Both" disabled="False" id="id4390C25825682" log="True" position="2">
+          <PolicyRule id="id4390C25825682" action="Deny" direction="Both" disabled="False" log="True" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5420,7 +5527,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Both" disabled="False" id="id446FB0ED10619" log="True" position="3">
+          <PolicyRule id="id446FB0ED10619" action="Deny" direction="Both" disabled="False" log="True" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5440,7 +5547,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Both" disabled="False" id="id452762A85348" log="True" position="4">
+          <PolicyRule id="id452762A85348" action="Deny" direction="Both" disabled="False" log="True" position="4">
             <Src neg="False">
               <ObjectRef ref="id452762A75348"/>
             </Src>
@@ -5460,7 +5567,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Both" disabled="False" id="id4389EDC118346" log="False" position="5">
+          <PolicyRule id="id4389EDC118346" action="Deny" direction="Both" disabled="False" log="False" position="5">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5481,7 +5588,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Both" disabled="False" id="id4388CFF8674" log="True" position="6">
+          <PolicyRule id="id4388CFF8674" action="Deny" direction="Both" disabled="False" log="True" position="6">
             <Src neg="False">
               <ObjectRef ref="id4389EE9118346"/>
             </Src>
@@ -5501,7 +5608,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Both" disabled="False" id="id4388C36F674" log="True" position="7">
+          <PolicyRule id="id4388C36F674" action="Deny" direction="Both" disabled="False" log="True" position="7">
             <Src neg="False">
               <ObjectRef ref="id4389EE9118346"/>
               <ObjectRef ref="id4388C37D674"/>
@@ -5522,7 +5629,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Both" disabled="True" id="id4388F5A9674" log="False" position="8">
+          <PolicyRule id="id4388F5A9674" action="Accept" direction="Both" disabled="True" log="False" position="8">
             <Src neg="True">
               <ObjectRef ref="id4389EE9118346"/>
               <ObjectRef ref="id4388C37D674"/>
@@ -5541,7 +5648,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id4389EEA118346" log="False" position="9">
+          <PolicyRule id="id4389EEA118346" action="Accept" direction="Both" disabled="False" log="False" position="9">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5576,7 +5683,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id4389EDCD18346" log="False" position="10">
+          <PolicyRule id="id4389EDCD18346" action="Accept" direction="Both" disabled="False" log="False" position="10">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -5594,7 +5701,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Both" disabled="False" id="id4389EE3C18346" log="True" position="11">
+          <PolicyRule id="id4389EE3C18346" action="Deny" direction="Both" disabled="False" log="True" position="11">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5616,12 +5723,12 @@
           </PolicyRule>
         </Policy>
         <Routing id="id4389EE8318346" name="Routing"/>
-        <Interface bridgeport="False" comment="VLAN interface" dyn="True" id="id4389EE8418346" label="" mgmt="False" name="eth0.100" security_level="0" unnum="False" unprotected="False"/>
-        <Interface bridgeport="False" dyn="False" id="id4389EE8518346" name="lo" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id4389EE8418346" name="eth0.100" comment="VLAN interface" bridgeport="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False"/>
+        <Interface id="id4389EE8518346" name="lo" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id4389EE8718346" name="firewall34:lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
-        <Interface bridgeport="False" comment="" dyn="False" id="id4389EE8818346" label="" mgmt="True" name="eth1" security_level="100" unnum="False" unprotected="False">
-          <IPv4 comment="" id="id4389EE8A18346" name="firewall34:eth1:ip" address="192.168.1.100" netmask="255.255.255.0"/>
+        <Interface id="id4389EE8818346" name="eth1" bridgeport="False" dyn="False" label="" mgmt="True" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id4389EE8A18346" name="firewall34:eth1:ip" address="192.168.1.100" netmask="255.255.255.0"/>
         </Interface>
         <Management address="192.168.1.100">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -5713,9 +5820,9 @@
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall comment="testing rules with tag service" host_OS="freebsd" id="id43EC5DDC2355" inactive="False" lastCompiled="1157930811" lastInstalled="0" lastModified="1190517707" name="firewall38" platform="pf" ro="False" version="">
+      <Firewall id="id43EC5DDC2355" name="firewall38" comment="testing rules with tag service" host_OS="freebsd" inactive="False" lastCompiled="1215308323" lastInstalled="0" lastModified="1215308308" platform="pf" ro="False" version="">
         <NAT id="id43EC5E1F2355" name="NAT">
-          <NATRule disabled="False" id="id43EC5E2E2355" position="0">
+          <NATRule id="id43EC5E2E2355" disabled="False" position="0">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -5736,7 +5843,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule comment="" disabled="False" id="id43EC5E6E2355" position="1">
+          <NATRule id="id43EC5E6E2355" disabled="False" position="1">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -5759,7 +5866,7 @@
           </NATRule>
         </NAT>
         <Policy id="id43EC5DE22355" name="Policy">
-          <PolicyRule action="Tag" direction="Inbound" disabled="False" id="id43EC5DE32355" log="False" position="0">
+          <PolicyRule id="id43EC5DE32355" action="Tag" direction="Inbound" disabled="False" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5785,7 +5892,7 @@
               <Option name="tagobject_id">id43F4556A28869</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Inbound" disabled="False" id="id43F447F228869" log="False" position="1">
+          <PolicyRule id="id43F447F228869" action="Accept" direction="Inbound" disabled="False" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5803,7 +5910,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Outbound" disabled="False" id="id43F4555D28869" log="False" position="2">
+          <PolicyRule id="id43F4555D28869" action="Accept" direction="Outbound" disabled="False" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5821,7 +5928,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Outbound" disabled="False" id="id43F462CA28869" log="False" position="3">
+          <PolicyRule id="id43F462CA28869" action="Accept" direction="Outbound" disabled="False" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5839,7 +5946,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id43EC5DEF2355" log="False" position="4">
+          <PolicyRule id="id43EC5DEF2355" action="Accept" direction="Both" disabled="False" log="False" position="4">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5857,7 +5964,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id43EC6B8B2355" log="False" position="5">
+          <PolicyRule id="id43EC6B8B2355" action="Accept" direction="Both" disabled="False" log="False" position="5">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5875,7 +5982,26 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Both" disabled="True" id="id43EC6BAF2355" log="False" position="6">
+          <PolicyRule id="id1391220443" action="Accept" direction="Both" disabled="False" group="" log="False" position="6">
+            <Src neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="id43EC6B892355"/>
+              <ServiceRef ref="id1391120443"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions/>
+          </PolicyRule>
+          <PolicyRule id="id43EC6BAF2355" action="Accept" direction="Both" disabled="True" log="False" position="7">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5893,7 +6019,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id43EC6BC02355" log="False" position="7">
+          <PolicyRule id="id43EC6BC02355" action="Accept" direction="Both" disabled="False" log="False" position="8">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5912,7 +6038,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Both" disabled="True" id="id43EC6BEA2355" log="False" position="8">
+          <PolicyRule id="id43EC6BEA2355" action="Accept" direction="Both" disabled="True" log="False" position="9">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5931,7 +6057,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Classify" direction="Both" disabled="False" id="id43F4407F28542" log="False" position="9">
+          <PolicyRule id="id43F4407F28542" action="Classify" direction="Both" disabled="False" log="False" position="10">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -5958,7 +6084,7 @@
               <Option name="tagvalue"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Both" disabled="False" id="id43EC5E132355" log="True" position="10">
+          <PolicyRule id="id43EC5E132355" action="Deny" direction="Both" disabled="False" log="True" position="11">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -5980,15 +6106,15 @@
           </PolicyRule>
         </Policy>
         <Routing id="id43EC5E3C2355" name="Routing"/>
-        <Interface bridgeport="False" comment="" dyn="False" id="id43EC5E3D2355" label="int_if" mgmt="False" name="le0" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id43EC5E3D2355" name="le0" bridgeport="False" dyn="False" label="int_if" mgmt="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id43EC5E3F2355" name="firewall38:le0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" comment="" dyn="False" id="id43EC5E402355" label="ext_if" mgmt="False" name="enc0" security_level="0" unnum="True" unprotected="False"/>
-        <Interface bridgeport="False" dyn="False" id="id43EC5E412355" name="lo" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id43EC5E402355" name="enc0" bridgeport="False" dyn="False" label="ext_if" mgmt="False" security_level="0" unnum="True" unprotected="False"/>
+        <Interface id="id43EC5E412355" name="lo" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id43EC5E432355" name="firewall38:lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
-        <Interface bridgeport="False" comment="" dyn="False" id="id43F447EB28869" label="wifi_int" mgmt="False" name="enc1" security_level="0" unnum="False" unprotected="False">
-          <IPv4 comment="" id="id43F447EC28869" name="firewall38:enc1:ip" address="192.168.2.1" netmask="255.255.255.0"/>
+        <Interface id="id43F447EB28869" name="enc1" bridgeport="False" dyn="False" label="wifi_int" mgmt="False" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id43F447EC28869" name="firewall38:enc1:ip" address="192.168.2.1" netmask="255.255.255.0"/>
         </Interface>
         <Management address="127.0.0.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -6109,9 +6235,9 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall comment="testing NAT rules with multiple objects in TSrc and TDst and NAT rule options" host_OS="openbsd" id="id43F7DBEE31316" inactive="False" lastCompiled="1157930807" lastInstalled="0" lastModified="1200415192" name="firewall3" platform="pf" ro="False" version="">
+      <Firewall id="id43F7DBEE31316" name="firewall3" comment="testing NAT rules with multiple objects in TSrc and TDst and NAT rule options" host_OS="openbsd" inactive="False" lastCompiled="1157930807" lastInstalled="0" lastModified="1200415192" platform="pf" ro="False" version="">
         <NAT id="id43F7DC6531316" name="NAT">
-          <NATRule disabled="False" id="id43F7DC6631316" position="0">
+          <NATRule id="id43F7DC6631316" disabled="False" position="0">
             <OSrc neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </OSrc>
@@ -6139,7 +6265,7 @@
               <Option name="pf_static_port">False</Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule comment="" disabled="False" id="id43F7DCC331316" position="1">
+          <NATRule id="id43F7DCC331316" disabled="False" position="1">
             <OSrc neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </OSrc>
@@ -6172,7 +6298,7 @@
               <Option name="pf_static_port">False</Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule comment="" disabled="False" id="id43F7DCD731316" position="2">
+          <NATRule id="id43F7DCD731316" disabled="False" position="2">
             <OSrc neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </OSrc>
@@ -6200,7 +6326,7 @@
               <Option name="pf_static_port">False</Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule comment="" disabled="False" id="id43F7DD1431316" position="3">
+          <NATRule id="id43F7DD1431316" disabled="False" position="3">
             <OSrc neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </OSrc>
@@ -6228,7 +6354,7 @@
               <Option name="pf_static_port">True</Option>
             </NATRuleOptions>
           </NATRule>
-          <NATRule disabled="False" id="id43F7E942514" position="4">
+          <NATRule id="id43F7E942514" disabled="False" position="4">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -6259,7 +6385,7 @@
           </NATRule>
         </NAT>
         <Policy id="id43F7DBF431316" name="Policy">
-          <PolicyRule action="Deny" comment="All other attempts to connect to&#10;the firewall are denied and logged" direction="Both" disabled="False" id="id43F7DC4131316" log="True" position="0">
+          <PolicyRule id="id43F7DC4131316" comment="All other attempts to connect to&#10;the firewall are denied and logged" action="Deny" direction="Both" disabled="False" log="True" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6279,7 +6405,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id43F7DC4D31316" log="False" position="1">
+          <PolicyRule id="id43F7DC4D31316" action="Accept" direction="Both" disabled="False" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </Src>
@@ -6306,15 +6432,15 @@
           </PolicyRule>
         </Policy>
         <Routing id="id43F7DC7431316" name="Routing"/>
-        <Interface bridgeport="False" comment="" dyn="False" id="id43F7DC7531316" label="" mgmt="False" name="le0" security_level="0" unnum="False" unprotected="False">
-          <IPv4 comment="" id="id43F7DCEB31316" name="firewall3:le0:ip-1" address="22.22.22.21" netmask="255.255.255.0"/>
-          <IPv4 comment="" id="id43F7DCEC31316" name="firewall3:le0:ip-2" address="22.22.22.22" netmask="255.255.255.0"/>
+        <Interface id="id43F7DC7531316" name="le0" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id43F7DCEB31316" name="firewall3:le0:ip-1" address="22.22.22.21" netmask="255.255.255.0"/>
+          <IPv4 id="id43F7DCEC31316" name="firewall3:le0:ip-2" address="22.22.22.22" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" comment="" dyn="False" id="id43F7DC7631316" label="" mgmt="True" name="le1" security_level="100" unnum="False" unprotected="False">
-          <IPv4 comment="" id="id43F7DC7831316" name="firewall3:le1:ip" address="192.168.1.1" netmask="255.255.255.0"/>
+        <Interface id="id43F7DC7631316" name="le1" bridgeport="False" dyn="False" label="" mgmt="True" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id43F7DC7831316" name="firewall3:le1:ip" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" comment="" dyn="False" id="id43F7DC7931316" label="" mgmt="False" name="lo" security_level="100" unnum="False" unprotected="False">
-          <IPv4 comment="" id="id43F7DC7B31316" name="firewall3:lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
+        <Interface id="id43F7DC7931316" name="lo" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id43F7DC7B31316" name="firewall3:lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
         <Management address="0.0.0.0">
           <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -6429,9 +6555,9 @@
           <Option name="verify_interfaces">true</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall comment="testing branching rules" host_OS="freebsd" id="id445DB34232739" inactive="False" lastCompiled="1157930813" lastInstalled="0" lastModified="1190517710" name="firewall39" platform="pf" ro="False" version="">
+      <Firewall id="id445DB34232739" name="firewall39" comment="testing branching rules" host_OS="freebsd" inactive="False" lastCompiled="1157930813" lastInstalled="0" lastModified="1190517710" platform="pf" ro="False" version="">
         <NAT id="id445DB3CF32739" name="NAT">
-          <NATRule disabled="False" id="id445DB3D032739" position="0">
+          <NATRule id="id445DB3D032739" disabled="False" position="0">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -6452,7 +6578,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule comment="" disabled="False" id="id445DB3DE32739" position="1">
+          <NATRule id="id445DB3DE32739" disabled="False" position="1">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -6475,7 +6601,7 @@
           </NATRule>
         </NAT>
         <Policy id="id445DB34832739" name="Policy">
-          <PolicyRule action="Tag" direction="Inbound" disabled="False" id="id445DB34932739" log="False" position="0">
+          <PolicyRule id="id445DB34932739" action="Tag" direction="Inbound" disabled="False" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6501,7 +6627,7 @@
               <Option name="tagobject_id">id43F4556A28869</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Inbound" disabled="False" id="id445DB35532739" log="False" position="1">
+          <PolicyRule id="id445DB35532739" action="Accept" direction="Inbound" disabled="False" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6519,7 +6645,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Branch" comment="logging is not allowed with 'anchor'&#10;compiler should not generate 'log' keyword&#10;" direction="Inbound" disabled="False" id="id445DB36132739" log="True" position="2">
+          <PolicyRule id="id445DB36132739" comment="logging is not allowed with 'anchor'&#10;compiler should not generate 'log' keyword&#10;" action="Branch" direction="Inbound" disabled="False" log="True" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6540,7 +6666,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Branch" direction="Inbound" disabled="False" id="id445DB36D32739" log="False" position="3">
+          <PolicyRule id="id445DB36D32739" action="Branch" direction="Inbound" disabled="False" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6561,7 +6687,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id445DB37932739" log="False" position="4">
+          <PolicyRule id="id445DB37932739" action="Accept" direction="Both" disabled="False" log="False" position="4">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6579,7 +6705,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Branch" direction="Both" disabled="False" id="id445DB38532739" log="False" position="5">
+          <PolicyRule id="id445DB38532739" action="Branch" direction="Both" disabled="False" log="False" position="5">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6600,7 +6726,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id445DB39132739" log="False" position="6">
+          <PolicyRule id="id445DB39132739" action="Accept" direction="Both" disabled="False" log="False" position="6">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6618,7 +6744,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id445DB39D32739" log="False" position="7">
+          <PolicyRule id="id445DB39D32739" action="Accept" direction="Both" disabled="False" log="False" position="7">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6637,7 +6763,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Both" disabled="True" id="id445DB3AA32739" log="False" position="8">
+          <PolicyRule id="id445DB3AA32739" action="Accept" direction="Both" disabled="True" log="False" position="8">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6656,7 +6782,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Classify" direction="Both" disabled="False" id="id445DB3B732739" log="False" position="9">
+          <PolicyRule id="id445DB3B732739" action="Classify" direction="Both" disabled="False" log="False" position="9">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -6683,7 +6809,7 @@
               <Option name="tagvalue"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Both" disabled="False" id="id445DB3C332739" log="True" position="10">
+          <PolicyRule id="id445DB3C332739" action="Deny" direction="Both" disabled="False" log="True" position="10">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6705,7 +6831,7 @@
           </PolicyRule>
         </Policy>
         <Policy id="id445DB3FE32739" name="rule2_branch">
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id445DB40A32739" log="False" position="0">
+          <PolicyRule id="id445DB40A32739" action="Accept" direction="Both" disabled="False" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6723,7 +6849,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Both" disabled="False" id="id445DB42332739" log="True" position="1">
+          <PolicyRule id="id445DB42332739" action="Deny" direction="Both" disabled="False" log="True" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6745,7 +6871,7 @@
           </PolicyRule>
         </Policy>
         <Policy id="id445DB3FF32739" name="rule3_branch">
-          <PolicyRule action="Accept" direction="Inbound" disabled="False" id="id445DB41632739" log="False" position="0">
+          <PolicyRule id="id445DB41632739" action="Accept" direction="Inbound" disabled="False" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6763,7 +6889,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id445DB43032739" log="False" position="1">
+          <PolicyRule id="id445DB43032739" action="Accept" direction="Both" disabled="False" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6782,7 +6908,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Both" disabled="False" id="id445DB43E32739" log="True" position="2">
+          <PolicyRule id="id445DB43E32739" action="Deny" direction="Both" disabled="False" log="True" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6805,15 +6931,15 @@
         </Policy>
         <Policy id="id445DB40032739" name="rule5_branch"/>
         <Routing id="id445DB3EC32739" name="Routing"/>
-        <Interface bridgeport="False" comment="" dyn="False" id="id445DB3ED32739" label="int_if" mgmt="False" name="le0" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id445DB3ED32739" name="le0" bridgeport="False" dyn="False" label="int_if" mgmt="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id445DB3EF32739" name="firewall39:le0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" comment="" dyn="False" id="id445DB3F032739" label="ext_if" mgmt="False" name="enc0" security_level="0" unnum="True" unprotected="False"/>
-        <Interface bridgeport="False" dyn="False" id="id445DB3F132739" name="lo" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id445DB3F032739" name="enc0" bridgeport="False" dyn="False" label="ext_if" mgmt="False" security_level="0" unnum="True" unprotected="False"/>
+        <Interface id="id445DB3F132739" name="lo" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id445DB3F332739" name="firewall39:lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
-        <Interface bridgeport="False" comment="" dyn="False" id="id445DB3F432739" label="wifi_int" mgmt="False" name="enc1" security_level="0" unnum="False" unprotected="False">
-          <IPv4 comment="" id="id445DB3F632739" name="firewall39:enc1:ip" address="192.168.2.1" netmask="255.255.255.0"/>
+        <Interface id="id445DB3F432739" name="enc1" bridgeport="False" dyn="False" label="wifi_int" mgmt="False" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id445DB3F632739" name="firewall39:enc1:ip" address="192.168.2.1" netmask="255.255.255.0"/>
         </Interface>
         <Management address="127.0.0.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -6934,9 +7060,9 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall comment="testing Route action&#10;" host_OS="openbsd" id="id44948F9F2976" inactive="False" lastCompiled="1157930816" lastInstalled="0" lastModified="1193632410" name="firewall40" platform="pf" ro="False" version="">
+      <Firewall id="id44948F9F2976" name="firewall40" comment="testing Route action&#10;" host_OS="openbsd" inactive="False" lastCompiled="1157930816" lastInstalled="0" lastModified="1193632410" platform="pf" ro="False" version="">
         <NAT id="id449490392976" name="NAT">
-          <NATRule comment="Translate source address&#10;for outgoing connections" disabled="False" id="id449490482976" position="0">
+          <NATRule id="id449490482976" comment="Translate source address&#10;for outgoing connections" disabled="False" position="0">
             <OSrc neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </OSrc>
@@ -6957,7 +7083,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule comment="Translate source address&#10;for outgoing connections" disabled="False" id="id4494A6FF3539" position="1">
+          <NATRule id="id4494A6FF3539" comment="Translate source address&#10;for outgoing connections" disabled="False" position="1">
             <OSrc neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </OSrc>
@@ -6980,7 +7106,7 @@
           </NATRule>
         </NAT>
         <Policy id="id44948FA52976" name="Policy">
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id44957E2D3539" log="False" position="0">
+          <PolicyRule id="id44957E2D3539" action="Accept" direction="Both" disabled="False" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -7005,7 +7131,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id44957E3A3539" log="False" position="1">
+          <PolicyRule id="id44957E3A3539" action="Accept" direction="Both" disabled="False" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </Src>
@@ -7030,7 +7156,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Route" comment="" direction="Inbound" disabled="False" id="id449490212976" log="False" position="2">
+          <PolicyRule id="id449490212976" action="Route" direction="Inbound" disabled="False" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </Src>
@@ -7073,7 +7199,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Route" comment="" direction="Inbound" disabled="False" id="id4494AF342976" log="False" position="3">
+          <PolicyRule id="id4494AF342976" action="Route" direction="Inbound" disabled="False" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </Src>
@@ -7115,7 +7241,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Outbound" disabled="False" id="id44958DBE3539" log="False" position="4">
+          <PolicyRule id="id44958DBE3539" action="Accept" direction="Outbound" disabled="False" log="False" position="4">
             <Src neg="False">
               <ObjectRef ref="id44948F9F2976"/>
             </Src>
@@ -7133,7 +7259,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Deny" disabled="False" id="id4494902D2976" log="True" position="5">
+          <PolicyRule id="id4494902D2976" action="Deny" disabled="False" log="True" position="5">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -7155,17 +7281,17 @@
           </PolicyRule>
         </Policy>
         <Routing id="id449490652976" name="Routing"/>
-        <Interface bridgeport="False" comment="" dyn="False" id="id449490662976" label="" mgmt="False" name="le1" security_level="0" unnum="False" unprotected="False">
-          <IPv4 comment="This is a test address, change it to your real one" id="id449490682976" name="firewall40:le1:ip" address="192.0.2.1" netmask="255.255.255.0"/>
+        <Interface id="id449490662976" name="le1" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id449490682976" name="firewall40:le1:ip" comment="This is a test address, change it to your real one" address="192.0.2.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" comment="" dyn="False" id="id449490692976" label="" mgmt="True" name="fxp0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 comment="" id="id4494906B2976" name="firewall40:fxp0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
+        <Interface id="id449490692976" name="fxp0" bridgeport="False" dyn="False" label="" mgmt="True" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id4494906B2976" name="firewall40:fxp0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" comment="" dyn="False" id="id4494906C2976" label="" mgmt="False" name="lo0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 comment="" id="id4494906E2976" name="firewall40:lo0:ip" address="127.0.0.1" netmask="255.0.0.0"/>
+        <Interface id="id4494906C2976" name="lo0" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id4494906E2976" name="firewall40:lo0:ip" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
-        <Interface bridgeport="False" comment="" dyn="False" id="id4494906F2976" label="" mgmt="False" name="le2" security_level="0" unnum="False" unprotected="False">
-          <IPv4 comment="" id="id449490712976" name="firewall40:le2:ip" address="192.0.3.1" netmask="255.255.255.0"/>
+        <Interface id="id4494906F2976" name="le2" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id449490712976" name="firewall40:le2:ip" address="192.0.3.1" netmask="255.255.255.0"/>
         </Interface>
         <Management address="0.0.0.0">
           <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -7277,10 +7403,10 @@
           <Option name="verify_interfaces">true</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall comment="testing rule shadowing with run-time objects, rules with such objects should be ignored&#10;&#10;" host_OS="freebsd" id="id44EC18128791" inactive="False" lastCompiled="1157930818" lastInstalled="0" lastModified="1193632413" name="firewall41" platform="pf" ro="False" version="">
+      <Firewall id="id44EC18128791" name="firewall41" comment="testing rule shadowing with run-time objects, rules with such objects should be ignored&#10;&#10;" host_OS="freebsd" inactive="False" lastCompiled="1157930818" lastInstalled="0" lastModified="1193632413" platform="pf" ro="False" version="">
         <NAT id="id44EC18168791" name="NAT"/>
         <Policy id="id44EC18158791" name="Policy">
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id44EC181E8791" log="True" position="0">
+          <PolicyRule id="id44EC181E8791" action="Accept" direction="Both" disabled="False" log="True" position="0">
             <Src neg="False">
               <ObjectRef ref="id44EC18128791"/>
             </Src>
@@ -7298,7 +7424,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id44F7056428576" log="True" position="1">
+          <PolicyRule id="id44F7056428576" action="Accept" direction="Both" disabled="False" log="True" position="1">
             <Src neg="False">
               <ObjectRef ref="id44EC18128791"/>
             </Src>
@@ -7316,7 +7442,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id44F707E428576" log="True" position="2">
+          <PolicyRule id="id44F707E428576" action="Accept" direction="Both" disabled="False" log="True" position="2">
             <Src neg="False">
               <ObjectRef ref="id44EC18128791"/>
             </Src>
@@ -7336,10 +7462,10 @@
           </PolicyRule>
         </Policy>
         <Routing id="id44EC18178791" name="Routing"/>
-        <Interface bridgeport="False" dyn="False" id="id44EC18188791" label="ext" name="eth0" security_level="0" unnum="False" unprotected="False">
+        <Interface id="id44EC18188791" name="eth0" bridgeport="False" dyn="False" label="ext" security_level="0" unnum="False" unprotected="False">
           <IPv4 id="id44EC18198791" name="firewall41:eth0:ip" address="1.1.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" dyn="False" id="id44EC181A8791" label="int" name="eth1" security_level="50" unnum="False" unprotected="False">
+        <Interface id="id44EC181A8791" name="eth1" bridgeport="False" dyn="False" label="int" security_level="50" unnum="False" unprotected="False">
           <IPv4 id="id44EC181B8791" name="firewall41:eth1:ip" address="2.2.2.2" netmask="255.255.255.0"/>
         </Interface>
         <Management address="0.0.0.0">
@@ -7392,9 +7518,9 @@
           <Option name="verify_interfaces">true</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall comment="PF 3.x, testing &#10;&quot;flags S/SA keep state&quot;" host_OS="openbsd" id="id4699449021967" inactive="False" lastCompiled="1202682006" lastInstalled="0" lastModified="1202681966" name="firewall10-1" platform="pf" ro="False" version="3.x">
+      <Firewall id="id4699449021967" name="firewall10-1" comment="PF 3.x, testing &#10;&quot;flags S/SA keep state&quot;" host_OS="openbsd" inactive="False" lastCompiled="1202682006" lastInstalled="0" lastModified="1202681966" platform="pf" ro="False" version="3.x">
         <NAT id="id469944D321967" name="NAT">
-          <NATRule disabled="True" id="id469944D421967" position="0">
+          <NATRule id="id469944D421967" disabled="True" position="0">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -7415,7 +7541,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id469944E221967" position="1">
+          <NATRule id="id469944E221967" disabled="False" position="1">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -7438,7 +7564,7 @@
           </NATRule>
         </NAT>
         <Policy id="id4699449621967" name="Policy">
-          <PolicyRule action="Accept" direction="Inbound" disabled="False" id="id4699449721967" log="False" position="0">
+          <PolicyRule id="id4699449721967" action="Accept" direction="Inbound" disabled="False" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -7459,7 +7585,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id469944A321967" log="False" position="1">
+          <PolicyRule id="id469944A321967" action="Accept" direction="Both" disabled="False" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -7494,7 +7620,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="via ipsec" direction="Both" disabled="False" id="id469944AF21967" log="False" position="2">
+          <PolicyRule id="id469944AF21967" comment="via ipsec" action="Accept" direction="Both" disabled="False" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="id3B665643"/>
             </Src>
@@ -7529,7 +7655,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Both" disabled="False" id="id469944C721967" log="True" position="3">
+          <PolicyRule id="id469944C721967" action="Deny" direction="Both" disabled="False" log="True" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -7551,11 +7677,11 @@
           </PolicyRule>
         </Policy>
         <Routing id="id469944F021967" name="Routing"/>
-        <Interface bridgeport="False" dyn="False" id="id469944F121967" name="eth0" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id469944F121967" name="eth0" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id469944F321967" name="firewall10-1:eth0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" comment="" dyn="False" id="id469944F421967" label="" mgmt="False" name="enc0" security_level="0" unnum="True" unprotected="False"/>
-        <Interface bridgeport="False" comment="" dyn="False" id="id469944F521967" label="" mgmt="False" name="lo0" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id469944F421967" name="enc0" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="True" unprotected="False"/>
+        <Interface id="id469944F521967" name="lo0" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id469944F721967" name="firewall10-1:lo0:ip" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
         <Management address="127.0.0.1">
@@ -7684,9 +7810,9 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall comment="PF 4.x, testing &#10;&quot;flags S/SA keep state&quot;" host_OS="openbsd" id="id4699570022254" inactive="False" lastCompiled="1202682007" lastInstalled="0" lastModified="1202682031" name="firewall10-2" platform="pf" ro="False" version="4.x">
+      <Firewall id="id4699570022254" name="firewall10-2" comment="PF 4.x, testing &#10;&quot;flags S/SA keep state&quot;" host_OS="openbsd" inactive="False" lastCompiled="1202682007" lastInstalled="0" lastModified="1202682031" platform="pf" ro="False" version="4.x">
         <NAT id="id4699573822254" name="NAT">
-          <NATRule disabled="True" id="id4699573922254" position="0">
+          <NATRule id="id4699573922254" disabled="True" position="0">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -7707,7 +7833,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id4699574722254" position="1">
+          <NATRule id="id4699574722254" disabled="False" position="1">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -7730,7 +7856,7 @@
           </NATRule>
         </NAT>
         <Policy id="id4699570622254" name="Policy">
-          <PolicyRule action="Accept" direction="Inbound" disabled="False" id="id4699570722254" log="False" position="0">
+          <PolicyRule id="id4699570722254" action="Accept" direction="Inbound" disabled="False" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -7751,7 +7877,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id4699571422254" log="False" position="1">
+          <PolicyRule id="id4699571422254" action="Accept" direction="Both" disabled="False" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -7786,7 +7912,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="via ipsec" direction="Both" disabled="False" id="id4699572022254" log="False" position="2">
+          <PolicyRule id="id4699572022254" comment="via ipsec" action="Accept" direction="Both" disabled="False" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="id3B665643"/>
             </Src>
@@ -7821,7 +7947,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Both" disabled="False" id="id4699572C22254" log="True" position="3">
+          <PolicyRule id="id4699572C22254" action="Deny" direction="Both" disabled="False" log="True" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -7843,11 +7969,11 @@
           </PolicyRule>
         </Policy>
         <Routing id="id4699575522254" name="Routing"/>
-        <Interface bridgeport="False" dyn="False" id="id4699575622254" name="eth0" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id4699575622254" name="eth0" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id4699575822254" name="firewall10-2:eth0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" comment="" dyn="False" id="id4699575922254" label="" mgmt="False" name="enc0" security_level="0" unnum="True" unprotected="False"/>
-        <Interface bridgeport="False" comment="" dyn="False" id="id4699575A22254" label="" mgmt="False" name="lo0" security_level="100" unnum="False" unprotected="True">
+        <Interface id="id4699575922254" name="enc0" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="True" unprotected="False"/>
+        <Interface id="id4699575A22254" name="lo0" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="True">
           <IPv4 id="id4699575C22254" name="firewall10-2:lo0:ip" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
         <Management address="127.0.0.1">
@@ -7976,9 +8102,9 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall comment="PF 3.x, testing &#10;&quot;flags S/SA keep state&quot;&#10;&quot;Accept tcp sessions opened&#10;prior to restart&quot; ON&#10;" host_OS="openbsd" id="id469948EA22616" inactive="False" lastCompiled="1202682008" lastInstalled="0" lastModified="1202681977" name="firewall10-3" platform="pf" ro="False" version="3.x">
+      <Firewall id="id469948EA22616" name="firewall10-3" comment="PF 3.x, testing &#10;&quot;flags S/SA keep state&quot;&#10;&quot;Accept tcp sessions opened&#10;prior to restart&quot; ON&#10;" host_OS="openbsd" inactive="False" lastCompiled="1202682008" lastInstalled="0" lastModified="1202681977" platform="pf" ro="False" version="3.x">
         <NAT id="id4699492222616" name="NAT">
-          <NATRule disabled="True" id="id4699492322616" position="0">
+          <NATRule id="id4699492322616" disabled="True" position="0">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -7999,7 +8125,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id4699493122616" position="1">
+          <NATRule id="id4699493122616" disabled="False" position="1">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -8022,7 +8148,7 @@
           </NATRule>
         </NAT>
         <Policy id="id469948F022616" name="Policy">
-          <PolicyRule action="Accept" direction="Inbound" disabled="False" id="id469948F122616" log="False" position="0">
+          <PolicyRule id="id469948F122616" action="Accept" direction="Inbound" disabled="False" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -8043,7 +8169,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id469948FE22616" log="False" position="1">
+          <PolicyRule id="id469948FE22616" action="Accept" direction="Both" disabled="False" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -8078,7 +8204,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="via ipsec" direction="Both" disabled="False" id="id4699490A22616" log="False" position="2">
+          <PolicyRule id="id4699490A22616" comment="via ipsec" action="Accept" direction="Both" disabled="False" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="id3B665643"/>
             </Src>
@@ -8113,7 +8239,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Both" disabled="False" id="id4699491622616" log="True" position="3">
+          <PolicyRule id="id4699491622616" action="Deny" direction="Both" disabled="False" log="True" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -8135,11 +8261,11 @@
           </PolicyRule>
         </Policy>
         <Routing id="id4699493F22616" name="Routing"/>
-        <Interface bridgeport="False" dyn="False" id="id4699494022616" name="eth0" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id4699494022616" name="eth0" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id4699494222616" name="firewall10-3:eth0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" comment="" dyn="False" id="id4699494322616" label="" mgmt="False" name="enc0" security_level="0" unnum="True" unprotected="False"/>
-        <Interface bridgeport="False" comment="" dyn="False" id="id4699494422616" label="" mgmt="False" name="lo0" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id4699494322616" name="enc0" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="True" unprotected="False"/>
+        <Interface id="id4699494422616" name="lo0" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id4699494622616" name="firewall10-3:lo0:ip" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
         <Management address="127.0.0.1">
@@ -8268,9 +8394,9 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall comment="PF 4.x, testing &#10;&quot;flags S/SA keep state&quot;&#10;&quot;Accept tcp sessions opened&#10;prior to restart&quot; is ON&#10;" host_OS="openbsd" id="id4699494C22616" inactive="False" lastCompiled="1202682010" lastInstalled="0" lastModified="1202681983" name="firewall10-4" platform="pf" ro="False" version="4.x">
+      <Firewall id="id4699494C22616" name="firewall10-4" comment="PF 4.x, testing &#10;&quot;flags S/SA keep state&quot;&#10;&quot;Accept tcp sessions opened&#10;prior to restart&quot; is ON&#10;" host_OS="openbsd" inactive="False" lastCompiled="1202682010" lastInstalled="0" lastModified="1202681983" platform="pf" ro="False" version="4.x">
         <NAT id="id4699498422616" name="NAT">
-          <NATRule disabled="True" id="id4699498522616" position="0">
+          <NATRule id="id4699498522616" disabled="True" position="0">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -8291,7 +8417,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id4699499322616" position="1">
+          <NATRule id="id4699499322616" disabled="False" position="1">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -8314,7 +8440,7 @@
           </NATRule>
         </NAT>
         <Policy id="id4699495222616" name="Policy">
-          <PolicyRule action="Accept" direction="Inbound" disabled="False" id="id4699495322616" log="False" position="0">
+          <PolicyRule id="id4699495322616" action="Accept" direction="Inbound" disabled="False" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -8335,7 +8461,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id4699496022616" log="False" position="1">
+          <PolicyRule id="id4699496022616" action="Accept" direction="Both" disabled="False" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -8370,7 +8496,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="via ipsec" direction="Both" disabled="False" id="id4699496C22616" log="False" position="2">
+          <PolicyRule id="id4699496C22616" comment="via ipsec" action="Accept" direction="Both" disabled="False" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="id3B665643"/>
             </Src>
@@ -8405,7 +8531,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Both" disabled="False" id="id4699497822616" log="True" position="3">
+          <PolicyRule id="id4699497822616" action="Deny" direction="Both" disabled="False" log="True" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -8427,11 +8553,11 @@
           </PolicyRule>
         </Policy>
         <Routing id="id469949A122616" name="Routing"/>
-        <Interface bridgeport="False" dyn="False" id="id469949A222616" name="eth0" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id469949A222616" name="eth0" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id469949A422616" name="firewall10-4:eth0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" comment="" dyn="False" id="id469949A522616" label="" mgmt="False" name="enc0" security_level="0" unnum="True" unprotected="False"/>
-        <Interface bridgeport="False" comment="" dyn="False" id="id469949A622616" label="" mgmt="False" name="lo0" security_level="100" unnum="False" unprotected="True">
+        <Interface id="id469949A522616" name="enc0" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="True" unprotected="False"/>
+        <Interface id="id469949A622616" name="lo0" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="True">
           <IPv4 id="id469949A822616" name="firewall10-4:lo0:ip" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
         <Management address="127.0.0.1">
@@ -8560,9 +8686,9 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall comment="PF 3.x, testing &#10;&quot;flags S/SA keep state&quot;&#10;&quot;Accept tcp sessions opened&#10;prior to restart&quot; ON&#10;Using &quot;pass all outgoing&quot;&#10;" host_OS="openbsd" id="id46F605DE10002" inactive="False" lastCompiled="1202682011" lastInstalled="0" lastModified="1202681989" name="firewall10-5" platform="pf" ro="False" version="3.x">
+      <Firewall id="id46F605DE10002" name="firewall10-5" comment="PF 3.x, testing &#10;&quot;flags S/SA keep state&quot;&#10;&quot;Accept tcp sessions opened&#10;prior to restart&quot; ON&#10;Using &quot;pass all outgoing&quot;&#10;" host_OS="openbsd" inactive="False" lastCompiled="1202682011" lastInstalled="0" lastModified="1202681989" platform="pf" ro="False" version="3.x">
         <NAT id="id46F6061610002" name="NAT">
-          <NATRule disabled="True" id="id46F6061710002" position="0">
+          <NATRule id="id46F6061710002" disabled="True" position="0">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -8583,7 +8709,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id46F6062510002" position="1">
+          <NATRule id="id46F6062510002" disabled="False" position="1">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -8606,7 +8732,7 @@
           </NATRule>
         </NAT>
         <Policy id="id46F605E410002" name="Policy">
-          <PolicyRule action="Accept" comment="This adds &quot;pass  out ... keep state&quot; &#10;rule that compiler 2.1.14&#10;does not add automatically for pf 3.x&#10;Note that checkbox &quot;add 'keep state'&quot;&#10;is on in options&#10;" direction="Outbound" disabled="False" id="id46F6520210002" log="False" position="0">
+          <PolicyRule id="id46F6520210002" comment="This adds &quot;pass  out ... keep state&quot; &#10;rule that compiler 2.1.14&#10;does not add automatically for pf 3.x&#10;Note that checkbox &quot;add 'keep state'&quot;&#10;is on in options&#10;" action="Accept" direction="Outbound" disabled="False" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -8641,7 +8767,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Inbound" disabled="False" id="id46F605E510002" log="False" position="1">
+          <PolicyRule id="id46F605E510002" action="Accept" direction="Inbound" disabled="False" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -8662,7 +8788,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id46F605F210002" log="False" position="2">
+          <PolicyRule id="id46F605F210002" action="Accept" direction="Both" disabled="False" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -8697,7 +8823,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="via ipsec" direction="Both" disabled="False" id="id46F605FE10002" log="False" position="3">
+          <PolicyRule id="id46F605FE10002" comment="via ipsec" action="Accept" direction="Both" disabled="False" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="id3B665643"/>
             </Src>
@@ -8732,7 +8858,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Both" disabled="False" id="id46F6060A10002" log="True" position="4">
+          <PolicyRule id="id46F6060A10002" action="Deny" direction="Both" disabled="False" log="True" position="4">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -8754,11 +8880,11 @@
           </PolicyRule>
         </Policy>
         <Routing id="id46F6063310002" name="Routing"/>
-        <Interface bridgeport="False" dyn="False" id="id46F6063410002" name="eth0" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id46F6063410002" name="eth0" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id46F6063610002" name="firewall10-5:eth0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" comment="" dyn="False" id="id46F6063710002" label="" mgmt="False" name="enc0" security_level="0" unnum="True" unprotected="False"/>
-        <Interface bridgeport="False" comment="" dyn="False" id="id46F6063810002" label="" mgmt="False" name="lo0" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id46F6063710002" name="enc0" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="True" unprotected="False"/>
+        <Interface id="id46F6063810002" name="lo0" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id46F6063A10002" name="firewall10-5:lo0:ip" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
         <Management address="127.0.0.1">
@@ -8887,9 +9013,9 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall comment="PF 4.x, testing &#10;&quot;flags S/SA keep state&quot;&#10;&quot;Accept tcp sessions opened&#10;prior to restart&quot; is ON&#10;Using &quot;pass all outgoing&quot;&#10;" host_OS="openbsd" id="id46F6064010002" inactive="False" lastCompiled="1202682012" lastInstalled="0" lastModified="1202681995" name="firewall10-6" platform="pf" ro="False" version="4.x">
+      <Firewall id="id46F6064010002" name="firewall10-6" comment="PF 4.x, testing &#10;&quot;flags S/SA keep state&quot;&#10;&quot;Accept tcp sessions opened&#10;prior to restart&quot; is ON&#10;Using &quot;pass all outgoing&quot;&#10;" host_OS="openbsd" inactive="False" lastCompiled="1202682012" lastInstalled="0" lastModified="1202681995" platform="pf" ro="False" version="4.x">
         <NAT id="id46F6067810002" name="NAT">
-          <NATRule disabled="True" id="id46F6067910002" position="0">
+          <NATRule id="id46F6067910002" disabled="True" position="0">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -8910,7 +9036,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id46F6068710002" position="1">
+          <NATRule id="id46F6068710002" disabled="False" position="1">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -8933,7 +9059,7 @@
           </NATRule>
         </NAT>
         <Policy id="id46F6064610002" name="Policy">
-          <PolicyRule action="Accept" direction="Inbound" disabled="False" id="id46F6064710002" log="False" position="0">
+          <PolicyRule id="id46F6064710002" action="Accept" direction="Inbound" disabled="False" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -8954,7 +9080,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id46F6065410002" log="False" position="1">
+          <PolicyRule id="id46F6065410002" action="Accept" direction="Both" disabled="False" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -8989,7 +9115,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="via ipsec" direction="Both" disabled="False" id="id46F6066010002" log="False" position="2">
+          <PolicyRule id="id46F6066010002" comment="via ipsec" action="Accept" direction="Both" disabled="False" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="id3B665643"/>
             </Src>
@@ -9024,7 +9150,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Both" disabled="False" id="id46F6066C10002" log="True" position="3">
+          <PolicyRule id="id46F6066C10002" action="Deny" direction="Both" disabled="False" log="True" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -9046,11 +9172,11 @@
           </PolicyRule>
         </Policy>
         <Routing id="id46F6069510002" name="Routing"/>
-        <Interface bridgeport="False" dyn="False" id="id46F6069610002" name="eth0" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id46F6069610002" name="eth0" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id46F6069810002" name="firewall10-6:eth0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" comment="" dyn="False" id="id46F6069910002" label="" mgmt="False" name="enc0" security_level="0" unnum="True" unprotected="False"/>
-        <Interface bridgeport="False" comment="" dyn="False" id="id46F6069A10002" label="" mgmt="False" name="lo0" security_level="100" unnum="False" unprotected="True">
+        <Interface id="id46F6069910002" name="enc0" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="True" unprotected="False"/>
+        <Interface id="id46F6069A10002" name="lo0" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="True">
           <IPv4 id="id46F6069C10002" name="firewall10-6:lo0:ip" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
         <Management address="127.0.0.1">
@@ -9179,9 +9305,9 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall comment="testing Route action&#10;with load balancing&#10;" host_OS="openbsd" id="id476458AA9697" inactive="False" lastCompiled="1157930816" lastInstalled="0" lastModified="1197750649" name="firewall40-1" platform="pf" ro="False" version="">
+      <Firewall id="id476458AA9697" name="firewall40-1" comment="testing Route action&#10;with load balancing&#10;" host_OS="openbsd" inactive="False" lastCompiled="1157930816" lastInstalled="0" lastModified="1197750649" platform="pf" ro="False" version="">
         <NAT id="id476458FA9697" name="NAT">
-          <NATRule comment="Translate source address&#10;for outgoing connections" disabled="False" id="id476458FB9697" position="0">
+          <NATRule id="id476458FB9697" comment="Translate source address&#10;for outgoing connections" disabled="False" position="0">
             <OSrc neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </OSrc>
@@ -9202,7 +9328,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule comment="Translate source address&#10;for outgoing connections" disabled="False" id="id476459099697" position="1">
+          <NATRule id="id476459099697" comment="Translate source address&#10;for outgoing connections" disabled="False" position="1">
             <OSrc neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </OSrc>
@@ -9225,7 +9351,7 @@
           </NATRule>
         </NAT>
         <Policy id="id476458B09697" name="Policy">
-          <PolicyRule action="Route" comment="" direction="Inbound" disabled="False" id="id47646C979697" log="False" position="0">
+          <PolicyRule id="id47646C979697" action="Route" direction="Inbound" disabled="False" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </Src>
@@ -9284,7 +9410,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Route" comment="" direction="Inbound" disabled="False" id="id47646C869697" log="False" position="1">
+          <PolicyRule id="id47646C869697" action="Route" direction="Inbound" disabled="False" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </Src>
@@ -9343,7 +9469,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Route" comment="" direction="Inbound" disabled="False" id="id47646C759697" log="False" position="2">
+          <PolicyRule id="id47646C759697" action="Route" direction="Inbound" disabled="False" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </Src>
@@ -9402,7 +9528,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Route" comment="" direction="Inbound" disabled="False" id="id476480059697" log="False" position="3">
+          <PolicyRule id="id476480059697" action="Route" direction="Inbound" disabled="False" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </Src>
@@ -9461,7 +9587,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Route" comment="" direction="Inbound" disabled="False" id="id476480169697" log="False" position="4">
+          <PolicyRule id="id476480169697" action="Route" direction="Inbound" disabled="False" log="False" position="4">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </Src>
@@ -9520,7 +9646,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Route" comment="" direction="Inbound" disabled="False" id="id476480279697" log="False" position="5">
+          <PolicyRule id="id476480279697" action="Route" direction="Inbound" disabled="False" log="False" position="5">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </Src>
@@ -9579,7 +9705,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Route" comment="" direction="Inbound" disabled="False" id="id476458C99697" log="False" position="6">
+          <PolicyRule id="id476458C99697" action="Route" direction="Inbound" disabled="False" log="False" position="6">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </Src>
@@ -9638,7 +9764,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Route" comment="" direction="Inbound" disabled="False" id="id476458D69697" log="False" position="7">
+          <PolicyRule id="id476458D69697" action="Route" direction="Inbound" disabled="False" log="False" position="7">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </Src>
@@ -9697,7 +9823,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Route" comment="" direction="Inbound" disabled="False" id="id4764592B9697" log="False" position="8">
+          <PolicyRule id="id4764592B9697" action="Route" direction="Inbound" disabled="False" log="False" position="8">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </Src>
@@ -9756,7 +9882,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Route" comment="this should fail because&#10;it has one address for the next&#10;hop and it is /32.&#10;Run compiler with&#10;command line argument -xt&#10;to convert errors to warnings&#10;and make it generate .conf &#10;file anyway" direction="Inbound" disabled="False" id="id4764BABB9697" log="False" position="9">
+          <PolicyRule id="id4764BABB9697" comment="this should fail because&#10;it has one address for the next&#10;hop and it is /32.&#10;Run compiler with&#10;command line argument -xt&#10;to convert errors to warnings&#10;and make it generate .conf &#10;file anyway" action="Route" direction="Inbound" disabled="False" log="False" position="9">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </Src>
@@ -9815,7 +9941,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Route" comment="this should fail because&#10;it has one address for the next&#10;hop and it is /32.&#10;" direction="Inbound" disabled="False" id="id4764BACC9697" log="False" position="10">
+          <PolicyRule id="id4764BACC9697" comment="this should fail because&#10;it has one address for the next&#10;hop and it is /32.&#10;" action="Route" direction="Inbound" disabled="False" log="False" position="10">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </Src>
@@ -9874,7 +10000,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Route" comment="this should fail because&#10;it ip address in next hop&#10;is illegal" direction="Inbound" disabled="False" id="id476509419697" log="False" position="11">
+          <PolicyRule id="id476509419697" comment="this should fail because&#10;it ip address in next hop&#10;is illegal" action="Route" direction="Inbound" disabled="False" log="False" position="11">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
             </Src>
@@ -9935,17 +10061,17 @@
           </PolicyRule>
         </Policy>
         <Routing id="id476459179697" name="Routing"/>
-        <Interface bridgeport="False" comment="" dyn="False" id="id476459189697" label="" mgmt="False" name="le1" security_level="0" unnum="False" unprotected="False">
-          <IPv4 comment="This is a test address, change it to your real one" id="id4764591A9697" name="firewall40-1:le1:ip" address="192.0.2.1" netmask="255.255.255.0"/>
+        <Interface id="id476459189697" name="le1" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id4764591A9697" name="firewall40-1:le1:ip" comment="This is a test address, change it to your real one" address="192.0.2.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" comment="" dyn="False" id="id4764591B9697" label="" mgmt="True" name="fxp0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 comment="" id="id4764591D9697" name="firewall40-1:fxp0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
+        <Interface id="id4764591B9697" name="fxp0" bridgeport="False" dyn="False" label="" mgmt="True" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id4764591D9697" name="firewall40-1:fxp0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" comment="" dyn="False" id="id4764591E9697" label="" mgmt="False" name="lo0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 comment="" id="id476459209697" name="firewall40-1:lo0:ip" address="127.0.0.1" netmask="255.0.0.0"/>
+        <Interface id="id4764591E9697" name="lo0" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id476459209697" name="firewall40-1:lo0:ip" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
-        <Interface bridgeport="False" comment="" dyn="False" id="id476459219697" label="" mgmt="False" name="le2" security_level="0" unnum="False" unprotected="False">
-          <IPv4 comment="" id="id476459239697" name="firewall40-1:le2:ip" address="192.0.3.1" netmask="255.255.255.0"/>
+        <Interface id="id476459219697" name="le2" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id476459239697" name="firewall40-1:le2:ip" address="192.0.3.1" netmask="255.255.255.0"/>
         </Interface>
         <Management address="0.0.0.0">
           <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -10057,11 +10183,11 @@
           <Option name="verify_interfaces">true</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall comment="" host_OS="freebsd" id="id4833F62B6131" inactive="False" lastCompiled="1212115999" lastInstalled="0" lastModified="1212272477" name="firewall-ipv6-1" platform="pf" ro="False" version="">
+      <Firewall id="id4833F62B6131" name="firewall-ipv6-1" host_OS="freebsd" inactive="False" lastCompiled="1212115999" lastInstalled="0" lastModified="1212272477" platform="pf" ro="False" version="">
         <NAT id="id4833F62F6131" name="NAT"/>
         <Policy id="id483F5B7623190" name="Policy_ipv4"/>
         <Policy id="id4833F62E6131" name="Policy">
-          <PolicyRule action="Accept" direction="Both" disabled="False" group="" id="id4841FADE30813" log="False" position="0">
+          <PolicyRule id="id4841FADE30813" action="Accept" direction="Both" disabled="False" group="" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -10081,7 +10207,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="this rule shadows the next.&#10;Note that we add command line&#10;flag -xt to the compiler" direction="Both" disabled="False" group="" id="id4837BFE628819" log="False" position="1">
+          <PolicyRule id="id4837BFE628819" comment="this rule shadows the next.&#10;Note that we add command line&#10;flag -xt to the compiler" action="Accept" direction="Both" disabled="False" group="" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="id4834B9206131"/>
             </Src>
@@ -10101,7 +10227,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id4834578B6131" log="False" position="2">
+          <PolicyRule id="id4834578B6131" action="Accept" direction="Both" disabled="False" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="id48416A7216880"/>
             </Src>
@@ -10121,7 +10247,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id4834577C6131" log="True" position="3">
+          <PolicyRule id="id4834577C6131" action="Accept" direction="Both" disabled="False" log="True" position="3">
             <Src neg="False">
               <ObjectRef ref="id48416A7116880"/>
             </Src>
@@ -10141,7 +10267,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" group="" id="id4834D3038571" log="True" position="4">
+          <PolicyRule id="id4834D3038571" action="Accept" direction="Both" disabled="False" group="" log="True" position="4">
             <Src neg="False">
               <ObjectRef ref="id4834A2238571"/>
             </Src>
@@ -10161,7 +10287,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" group="" id="id4834D3108571" log="True" position="5">
+          <PolicyRule id="id4834D3108571" action="Accept" direction="Both" disabled="False" group="" log="True" position="5">
             <Src neg="False">
               <ObjectRef ref="id4834A2278571"/>
             </Src>
@@ -10181,7 +10307,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Both" disabled="False" group="" id="id4835040E8571" log="True" position="6">
+          <PolicyRule id="id4835040E8571" action="Accept" direction="Both" disabled="False" group="" log="True" position="6">
             <Src neg="False">
               <ObjectRef ref="id4834A2238571"/>
             </Src>
@@ -10201,7 +10327,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Both" disabled="False" group="" id="id4835041F8571" log="True" position="7">
+          <PolicyRule id="id4835041F8571" action="Accept" direction="Both" disabled="False" group="" log="True" position="7">
             <Src neg="False">
               <ObjectRef ref="id4834A2278571"/>
             </Src>
@@ -10221,7 +10347,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Inbound" disabled="False" id="id4834576F6131" log="True" position="8">
+          <PolicyRule id="id4834576F6131" action="Accept" direction="Inbound" disabled="False" log="True" position="8">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -10241,7 +10367,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id4834B9216131" log="True" position="9">
+          <PolicyRule id="id4834B9216131" action="Accept" direction="Both" disabled="False" log="True" position="9">
             <Src neg="False">
               <ObjectRef ref="id4834B9206131"/>
             </Src>
@@ -10261,7 +10387,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id483566468571" log="True" position="10">
+          <PolicyRule id="id483566468571" action="Accept" direction="Both" disabled="False" log="True" position="10">
             <Src neg="False">
               <ObjectRef ref="id4834A2238571"/>
             </Src>
@@ -10281,7 +10407,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id483566548571" log="True" position="11">
+          <PolicyRule id="id483566548571" action="Accept" direction="Both" disabled="False" log="True" position="11">
             <Src neg="False">
               <ObjectRef ref="id4834A2278571"/>
             </Src>
@@ -10303,13 +10429,13 @@
           </PolicyRule>
         </Policy>
         <Routing id="id4833F6306131" name="Routing"/>
-        <Interface bridgeport="False" dyn="False" id="id4833F6316131" label="" name="eth0" security_level="50" unnum="False" unprotected="False">
+        <Interface id="id4833F6316131" name="eth0" bridgeport="False" dyn="False" label="" security_level="50" unnum="False" unprotected="False">
           <IPv4 id="id4833F6326131" name="firewall-ipv6-1:eth0:ip" address="1.1.1.1" netmask="255.255.255.0"/>
-          <IPv6 comment="" id="id4833F6346131" name="firewall-ipv6-1:eth0:ipv6" address="fe80::21d:9ff:fe8b:8e94" netmask="64"/>
+          <IPv6 id="id4833F6346131" name="firewall-ipv6-1:eth0:ipv6" address="fe80::21d:9ff:fe8b:8e94" netmask="64"/>
         </Interface>
-        <Interface bridgeport="False" comment="" dyn="False" id="id4841FADB30813" label="" mgmt="False" name="lo" security_level="100" unnum="False" unprotected="False">
-          <IPv4 comment="" id="id4841FADC30813" name="firewall-ipv6-1:lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
-          <IPv6 comment="" id="id4841FADD30813" name="firewall-ipv6-1:lo:ipv6" address="::1" netmask="128"/>
+        <Interface id="id4841FADB30813" name="lo" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id4841FADC30813" name="firewall-ipv6-1:lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
+          <IPv6 id="id4841FADD30813" name="firewall-ipv6-1:lo:ipv6" address="::1" netmask="128"/>
         </Interface>
         <Management address="1.1.1.1">
           <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -10451,11 +10577,11 @@
           <Option name="verify_interfaces">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall comment="this firewall is used to test a rule in the global policy of object &quot;firewall&quot;&#10;" host_OS="openbsd" id="id4848A4294626" inactive="False" lastCompiled="1188097225" lastInstalled="1142003872" lastModified="1212696462" name="firewall-base-rulesets" platform="pf" ro="False" version="">
+      <Firewall id="id4848A4294626" name="firewall-base-rulesets" comment="this firewall is used to test a rule in the global policy of object &quot;firewall&quot;&#10;" host_OS="openbsd" inactive="False" lastCompiled="1188097225" lastInstalled="1142003872" lastModified="1212696462" platform="pf" ro="False" version="">
         <NAT id="id4848A4304626" name="NAT"/>
         <Policy id="id4848A42F4626" name="Policy"/>
-        <Policy comment="Basic rules for web servers.&#10;" id="id4848A4414626" name="web_server_inbound">
-          <PolicyRule action="Accept" direction="Inbound" disabled="False" id="id4848A4424626" log="False" position="0">
+        <Policy id="id4848A4414626" name="web_server_inbound" comment="Basic rules for web servers.&#10;">
+          <PolicyRule id="id4848A4424626" action="Accept" direction="Inbound" disabled="False" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -10475,7 +10601,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Inbound" disabled="False" id="id4848A44F4626" log="False" position="1">
+          <PolicyRule id="id4848A44F4626" action="Accept" direction="Inbound" disabled="False" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -10497,8 +10623,8 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Policy comment="Basic rules for mail servers" id="id48493B6E4626" name="mail_server_inbound">
-          <PolicyRule action="Accept" direction="Inbound" disabled="False" id="id48493B6F4626" log="False" position="0">
+        <Policy id="id48493B6E4626" name="mail_server_inbound" comment="Basic rules for mail servers">
+          <PolicyRule id="id48493B6F4626" action="Accept" direction="Inbound" disabled="False" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -10518,7 +10644,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Inbound" disabled="False" id="id48493B7B4626" log="False" position="1">
+          <PolicyRule id="id48493B7B4626" action="Accept" direction="Inbound" disabled="False" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -10540,8 +10666,8 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Policy comment="Basic rules for mail servers" id="id484B0A134626" name="mail_server_outbound">
-          <PolicyRule action="Accept" direction="Outbound" disabled="False" id="id484B0A2D4626" log="False" position="0">
+        <Policy id="id484B0A134626" name="mail_server_outbound" comment="Basic rules for mail servers">
+          <PolicyRule id="id484B0A2D4626" action="Accept" direction="Outbound" disabled="False" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -10562,7 +10688,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Outbound" disabled="False" group="" id="id484B0A3A4626" log="False" position="1">
+          <PolicyRule id="id484B0A3A4626" action="Accept" direction="Outbound" disabled="False" group="" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -10584,8 +10710,8 @@
             </PolicyRuleOptions>
           </PolicyRule>
         </Policy>
-        <Policy comment="Basic rules for web servers.&#10;" id="id484B3D324626" name="web_server_outbound">
-          <PolicyRule action="Accept" direction="Outbound" disabled="False" id="id484B3D3F4626" log="False" position="0">
+        <Policy id="id484B3D324626" name="web_server_outbound" comment="Basic rules for web servers.&#10;">
+          <PolicyRule id="id484B3D3F4626" action="Accept" direction="Outbound" disabled="False" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -10606,7 +10732,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Outbound" disabled="False" id="id484B3D4C4626" log="False" position="1">
+          <PolicyRule id="id484B3D4C4626" action="Accept" direction="Outbound" disabled="False" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -10628,13 +10754,13 @@
           </PolicyRule>
         </Policy>
         <Routing id="id4848A4314626" name="Routing"/>
-        <Interface bridgeport="False" comment="" dyn="False" id="id4848A4324626" label="" mgmt="False" name="en0" security_level="0" unnum="False" unprotected="False">
+        <Interface id="id4848A4324626" name="en0" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False">
           <IPv4 id="id4848A4344626" name="firewall-base-rulesets:en0:ip" address="33.33.33.33" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" comment="" dyn="False" id="id4848A4354626" label="" mgmt="False" name="en1" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id4848A4354626" name="en1" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id4848A4374626" name="firewall-base-rulesets:en1:ip" address="172.16.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" comment="" dyn="False" id="id4848A4384626" label="" mgmt="True" name="en2" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id4848A4384626" name="en2" bridgeport="False" dyn="False" label="" mgmt="True" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id4848A43A4626" name="firewall-base-rulesets:en2:ip" address="192.168.100.1" netmask="255.255.255.0"/>
         </Interface>
         <Management address="192.168.100.1">
@@ -10703,10 +10829,10 @@
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall comment="testing branching rules that point&#10;at rule sets defined in object&#10;firewall-base-rulesets" host_OS="openbsd" id="id484A05C44626" inactive="False" lastCompiled="1188097218" lastInstalled="1142003872" lastModified="1212696679" name="firewall51" platform="pf" ro="False" version="">
+      <Firewall id="id484A05C44626" name="firewall51" comment="testing branching rules that point&#10;at rule sets defined in object&#10;firewall-base-rulesets" host_OS="openbsd" inactive="False" lastCompiled="1188097218" lastInstalled="1142003872" lastModified="1212696679" platform="pf" ro="False" version="">
         <NAT id="id484A06174626" name="NAT"/>
         <Policy id="id484A05CA4626" name="Policy">
-          <PolicyRule action="Branch" direction="Both" disabled="False" id="id484A05CB4626" log="False" position="0">
+          <PolicyRule id="id484A05CB4626" action="Branch" direction="Both" disabled="False" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -10751,7 +10877,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Branch" comment="" direction="Both" disabled="False" group="" id="id484B704C4626" log="False" position="1">
+          <PolicyRule id="id484B704C4626" action="Branch" direction="Both" disabled="False" group="" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="host-hostA"/>
             </Src>
@@ -10796,7 +10922,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Branch" direction="Both" disabled="False" id="id484A05D84626" log="False" position="2">
+          <PolicyRule id="id484A05D84626" action="Branch" direction="Both" disabled="False" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -10841,7 +10967,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Branch" comment="" direction="Both" disabled="False" group="" id="id484B705F4626" log="False" position="3">
+          <PolicyRule id="id484B705F4626" action="Branch" direction="Both" disabled="False" group="" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="host-hostB"/>
             </Src>
@@ -10886,7 +11012,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Branch" direction="Both" disabled="False" id="id484A05E44626" log="False" position="4">
+          <PolicyRule id="id484A05E44626" action="Branch" direction="Both" disabled="False" log="False" position="4">
             <Src neg="False">
               <ObjectRef ref="id3CEBFDFC"/>
             </Src>
@@ -10910,7 +11036,7 @@
           </PolicyRule>
         </Policy>
         <Policy id="id484A06094626" name="rule2_branch">
-          <PolicyRule action="Deny" comment="" direction="Both" disabled="False" id="id484A060A4626" log="True" position="0">
+          <PolicyRule id="id484A060A4626" action="Deny" direction="Both" disabled="False" log="True" position="0">
             <Src neg="True">
               <ObjectRef ref="id3CEBFDFC"/>
               <ObjectRef ref="id4733FFE419714"/>
@@ -10933,15 +11059,15 @@
           </PolicyRule>
         </Policy>
         <Routing id="id484A06184626" name="Routing"/>
-        <Interface bridgeport="False" comment="" dyn="False" id="id484A06194626" label="" mgmt="True" name="en0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 comment="" id="id484A061B4626" name="firewall51:en0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
+        <Interface id="id484A06194626" name="en0" bridgeport="False" dyn="False" label="" mgmt="True" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id484A061B4626" name="firewall51:en0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" comment="" dyn="False" id="id484A061C4626" label="" mgmt="False" name="en1" security_level="0" unnum="False" unprotected="False">
+        <Interface id="id484A061C4626" name="en1" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False">
           <IPv4 id="id484A061E4626" name="firewall51:en1:ip" address="22.22.22.22" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" dyn="False" id="id484A061F4626" name="lo" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id484A061F4626" name="lo" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id484A06224626" name="firewall51:lo:ip1" address="127.0.0.1" netmask="255.0.0.0"/>
-          <IPv4 comment="" id="id484A06234626" name="firewall51:lo:ip2" address="192.168.1.1" netmask="255.255.255.0"/>
+          <IPv4 id="id484A06234626" name="firewall51:lo:ip2" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
         <Management address="0.0.0.0">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -11035,10 +11161,10 @@
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall comment="testing rules using UserService object&#10;Note that iptables does not allow entering&#10;iptables command that tries to match using module 'owner' in any chain&#10;other than OUTPUT. This includes user defined chains too (it checks&#10;how control passes to user defined chain and blocks command if&#10;it appears that user defined chain gets control not from OUTPUT)&#10;&#10;" host_OS="openbsd" id="id4848F19020246" inactive="False" lastCompiled="0" lastInstalled="0" lastModified="1212808094" name="firewall62" platform="pf" ro="False" version="4.x">
+      <Firewall id="id4848F19020246" name="firewall62" comment="testing rules using UserService object&#10;Note that iptables does not allow entering&#10;iptables command that tries to match using module 'owner' in any chain&#10;other than OUTPUT. This includes user defined chains too (it checks&#10;how control passes to user defined chain and blocks command if&#10;it appears that user defined chain gets control not from OUTPUT)&#10;&#10;" host_OS="openbsd" inactive="False" lastCompiled="0" lastInstalled="0" lastModified="1212808094" platform="pf" ro="False" version="4.x">
         <NAT id="id4848F1D320246" name="NAT"/>
         <Policy id="id4848F19620246" name="Policy">
-          <PolicyRule action="Accept" comment="rule from FR 1948872&#10;should generate&#10;pass in quick on en0 user proxy&#10;" direction="Inbound" disabled="False" group="" id="id484A6C465896" log="False" position="0">
+          <PolicyRule id="id484A6C465896" comment="rule from FR 1948872&#10;should generate&#10;pass in quick on en0 user proxy&#10;" action="Accept" direction="Inbound" disabled="False" group="" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -11058,7 +11184,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id4848F19720246" log="False" position="1">
+          <PolicyRule id="id4848F19720246" action="Accept" direction="Both" disabled="False" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="id4848F19020246"/>
             </Src>
@@ -11079,7 +11205,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Both" disabled="False" group="" id="id484A55A15896" log="False" position="2">
+          <PolicyRule id="id484A55A15896" action="Accept" direction="Both" disabled="False" group="" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="id4848F19020246"/>
             </Src>
@@ -11099,7 +11225,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Outbound" disabled="False" group="" id="id484A8D2620246" log="False" position="3">
+          <PolicyRule id="id484A8D2620246" action="Accept" direction="Outbound" disabled="False" group="" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="id4848F19020246"/>
             </Src>
@@ -11120,7 +11246,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Both" disabled="False" group="" id="id484A599620246" log="False" position="4">
+          <PolicyRule id="id484A599620246" action="Accept" direction="Both" disabled="False" group="" log="False" position="4">
             <Src neg="False">
               <ObjectRef ref="id4848F19020246"/>
             </Src>
@@ -11141,7 +11267,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Outbound" disabled="False" group="" id="id484A8D3820246" log="False" position="5">
+          <PolicyRule id="id484A8D3820246" action="Accept" direction="Outbound" disabled="False" group="" log="False" position="5">
             <Src neg="False">
               <ObjectRef ref="id4848F19020246"/>
             </Src>
@@ -11162,7 +11288,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Both" disabled="False" group="" id="id4848F1A320246" log="False" position="6">
+          <PolicyRule id="id4848F1A320246" action="Accept" direction="Both" disabled="False" group="" log="False" position="6">
             <Src neg="False">
               <ObjectRef ref="id4848F1D520246"/>
             </Src>
@@ -11182,7 +11308,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Both" disabled="False" group="" id="id4848F1AF20246" log="False" position="7">
+          <PolicyRule id="id4848F1AF20246" action="Accept" direction="Both" disabled="False" group="" log="False" position="7">
             <Src neg="False">
               <ObjectRef ref="id3CEBFDFC"/>
             </Src>
@@ -11202,7 +11328,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Both" disabled="False" group="" id="id4848F1BB20246" log="False" position="8">
+          <PolicyRule id="id4848F1BB20246" action="Accept" direction="Both" disabled="False" group="" log="False" position="8">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -11222,7 +11348,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Both" disabled="False" group="" id="id484A558F5896" log="False" position="9">
+          <PolicyRule id="id484A558F5896" action="Accept" direction="Both" disabled="False" group="" log="False" position="9">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -11243,7 +11369,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Inbound" disabled="False" group="" id="id484AF47A20246" log="False" position="10">
+          <PolicyRule id="id484AF47A20246" action="Accept" direction="Inbound" disabled="False" group="" log="False" position="10">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -11263,7 +11389,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Both" disabled="False" group="" id="id484A261420246" log="False" position="11">
+          <PolicyRule id="id484A261420246" action="Accept" direction="Both" disabled="False" group="" log="False" position="11">
             <Src neg="True">
               <ObjectRef ref="id3CEBFDFC"/>
             </Src>
@@ -11283,7 +11409,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Both" disabled="False" group="" id="id484A260320246" log="False" position="12">
+          <PolicyRule id="id484A260320246" action="Accept" direction="Both" disabled="False" group="" log="False" position="12">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -11303,7 +11429,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Both" disabled="False" id="id4848F1C720246" log="False" position="13">
+          <PolicyRule id="id4848F1C720246" action="Deny" direction="Both" disabled="False" log="False" position="13">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -11325,11 +11451,11 @@
           </PolicyRule>
         </Policy>
         <Routing id="id4848F1D420246" name="Routing"/>
-        <Interface bridgeport="False" comment="" dyn="False" id="id4848F1D520246" label="" mgmt="True" name="en0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 comment="" id="id4848F1D720246" name="firewall62:en0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
+        <Interface id="id4848F1D520246" name="en0" bridgeport="False" dyn="False" label="" mgmt="True" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id4848F1D720246" name="firewall62:en0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" comment="" dyn="False" id="id4848F1D820246" label="" mgmt="False" name="en1" security_level="0" unnum="False" unprotected="False">
-          <IPv4 comment="" id="id4848F1DA20246" name="firewall62:en1:ip" address="222.222.222.222" netmask="255.255.255.0"/>
+        <Interface id="id4848F1D820246" name="en1" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id4848F1DA20246" name="firewall62:en1:ip" address="222.222.222.222" netmask="255.255.255.0"/>
         </Interface>
         <Management address="192.168.1.1">
           <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -11418,6 +11544,282 @@
           <Option name="verify_interfaces">True</Option>
         </FirewallOptions>
       </Firewall>
+      <Firewall id="id530B20443" name="firewall63" comment="testing tos matching" host_OS="openbsd" inactive="False" lastCompiled="1215308098" lastInstalled="0" lastModified="1215308090" platform="pf" ro="False" version="">
+        <NAT id="id533820443" name="NAT">
+          <NATRule id="id533920443" disabled="True" position="0">
+            <OSrc neg="False">
+              <ObjectRef ref="net-Internal_net"/>
+            </OSrc>
+            <ODst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </ODst>
+            <OSrv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </OSrv>
+            <TSrc neg="False">
+              <ObjectRef ref="id530B20443"/>
+            </TSrc>
+            <TDst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </TDst>
+            <TSrv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </TSrv>
+            <NATRuleOptions/>
+          </NATRule>
+        </NAT>
+        <Policy id="id531120443" name="Policy">
+          <PolicyRule id="id531220443" action="Deny" direction="Both" disabled="False" log="True" position="0">
+            <Src neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="id3C6820443"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_value">0</Option>
+              <Option name="log_limit_suffix"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="idDCDE20443" action="Deny" direction="Both" disabled="False" group="" log="True" position="1">
+            <Src neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="idC5F120443"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_value">0</Option>
+              <Option name="log_limit_suffix"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="idF3EB20443" action="Deny" direction="Both" disabled="False" group="" log="True" position="2">
+            <Src neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="idC5F120443"/>
+              <ServiceRef ref="id3C6820443"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id531F20443" comment="DSCP matching is not&#10;supported by pf" action="Deny" direction="Both" disabled="True" log="True" position="3">
+            <Src neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="id3C6920443"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_value">0</Option>
+              <Option name="log_limit_suffix"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id532C20443" action="Deny" direction="Both" disabled="False" log="True" position="4">
+            <Src neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+        </Policy>
+        <Routing id="id534720443" name="Routing"/>
+        <Interface id="id534820443" name="eth1" bridgeport="False" dyn="False" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id534A20443" name="firewall63:eth1:ip" address="22.22.22.22" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface id="id534B20443" name="eth0" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id534D20443" name="firewall63:eth0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface id="id534E20443" name="lo" bridgeport="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id535020443" name="firewall63:lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
+        </Interface>
+        <Management address="127.0.0.1">
+          <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
+          <FWBDManagement enabled="True" identity="" port="9999"/>
+          <PolicyInstallScript arguments="" command="" enabled="False"/>
+        </Management>
+        <FirewallOptions>
+          <Option name="accept_established">False</Option>
+          <Option name="accept_new_tcp_with_no_syn">False</Option>
+          <Option name="action_on_reject">ICMP net unreachable</Option>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
+          <Option name="check_shading">False</Option>
+          <Option name="clamp_mss_to_mtu">False</Option>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
+          <Option name="configure_interfaces">False</Option>
+          <Option name="debug">False</Option>
+          <Option name="dyn_addr">False</Option>
+          <Option name="enable_ipv6">False</Option>
+          <Option name="epilog_script"></Option>
+          <Option name="fallback_log">False</Option>
+          <Option name="firewall_dir"></Option>
+          <Option name="firewall_is_part_of_any">True</Option>
+          <Option name="firewall_is_part_of_any_and_networks">True</Option>
+          <Option name="ignore_empty_groups">True</Option>
+          <Option name="in_out_code">True</Option>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
+          <Option name="ipv4_6_order">ipv4_first</Option>
+          <Option name="limit_suffix">/second</Option>
+          <Option name="limit_value">0</Option>
+          <Option name="linux24_ip_forward">0</Option>
+          <Option name="linux24_tcp_fin_timeout">30</Option>
+          <Option name="linux24_tcp_keepalive_interval">1800</Option>
+          <Option name="load_modules">False</Option>
+          <Option name="log_all_dropped">True</Option>
+          <Option name="log_ip_opt">False</Option>
+          <Option name="log_level">debug</Option>
+          <Option name="log_limit_suffix">/second</Option>
+          <Option name="log_limit_value">0</Option>
+          <Option name="log_prefix"></Option>
+          <Option name="log_tcp_opt">False</Option>
+          <Option name="log_tcp_seq">False</Option>
+          <Option name="manage_virtual_addr">True</Option>
+          <Option name="mgmt_addr"></Option>
+          <Option name="mgmt_ssh">False</Option>
+          <Option name="modulate_state">True</Option>
+          <Option name="no_iochains_for_any">False</Option>
+          <Option name="no_optimisation">False</Option>
+          <Option name="openbsd_ip_directed_broadcast">0</Option>
+          <Option name="openbsd_ip_forward">1</Option>
+          <Option name="openbsd_ip_redirect">0</Option>
+          <Option name="openbsd_ip_sourceroute">0</Option>
+          <Option name="openbsd_path_pfctl"></Option>
+          <Option name="openbsd_path_sysctl"></Option>
+          <Option name="output_file"></Option>
+          <Option name="pass_all_out">False</Option>
+          <Option name="pf_adaptive_end">0</Option>
+          <Option name="pf_adaptive_start">0</Option>
+          <Option name="pf_do_limit_frags">False</Option>
+          <Option name="pf_do_limit_src_nodes">False</Option>
+          <Option name="pf_do_limit_states">False</Option>
+          <Option name="pf_do_limit_table_entries">False</Option>
+          <Option name="pf_do_limit_tables">False</Option>
+          <Option name="pf_do_scrub">False</Option>
+          <Option name="pf_do_timeout_frag">False</Option>
+          <Option name="pf_do_timeout_interval">False</Option>
+          <Option name="pf_icmp_error">0</Option>
+          <Option name="pf_icmp_first">0</Option>
+          <Option name="pf_limit_frags">5000</Option>
+          <Option name="pf_limit_src_nodes">0</Option>
+          <Option name="pf_limit_states">10000</Option>
+          <Option name="pf_limit_table_entries">0</Option>
+          <Option name="pf_limit_tables">0</Option>
+          <Option name="pf_optimization"></Option>
+          <Option name="pf_other_first">0</Option>
+          <Option name="pf_other_multiple">0</Option>
+          <Option name="pf_other_single">0</Option>
+          <Option name="pf_scrub_fragm_crop">False</Option>
+          <Option name="pf_scrub_fragm_drop_ovl">False</Option>
+          <Option name="pf_scrub_maxmss">1460</Option>
+          <Option name="pf_scrub_minttl">1</Option>
+          <Option name="pf_scrub_no_df">False</Option>
+          <Option name="pf_scrub_random_id">False</Option>
+          <Option name="pf_scrub_reassemble">True</Option>
+          <Option name="pf_scrub_use_maxmss">False</Option>
+          <Option name="pf_scrub_use_minttl">False</Option>
+          <Option name="pf_set_adaptive">False</Option>
+          <Option name="pf_set_icmp_error">False</Option>
+          <Option name="pf_set_icmp_first">False</Option>
+          <Option name="pf_set_other_first">False</Option>
+          <Option name="pf_set_other_multiple">False</Option>
+          <Option name="pf_set_other_single">False</Option>
+          <Option name="pf_set_tcp_closed">False</Option>
+          <Option name="pf_set_tcp_closing">False</Option>
+          <Option name="pf_set_tcp_established">False</Option>
+          <Option name="pf_set_tcp_finwait">False</Option>
+          <Option name="pf_set_tcp_first">False</Option>
+          <Option name="pf_set_tcp_opening">False</Option>
+          <Option name="pf_set_udp_first">False</Option>
+          <Option name="pf_set_udp_multiple">False</Option>
+          <Option name="pf_set_udp_single">False</Option>
+          <Option name="pf_tcp_closed">0</Option>
+          <Option name="pf_tcp_closing">0</Option>
+          <Option name="pf_tcp_established">0</Option>
+          <Option name="pf_tcp_finwait">0</Option>
+          <Option name="pf_tcp_first">0</Option>
+          <Option name="pf_tcp_opening">0</Option>
+          <Option name="pf_timeout_frag">30</Option>
+          <Option name="pf_timeout_interval">10</Option>
+          <Option name="pf_udp_first">0</Option>
+          <Option name="pf_udp_multiple">0</Option>
+          <Option name="pf_udp_single">0</Option>
+          <Option name="platform">iptables</Option>
+          <Option name="prolog_place">fw_file</Option>
+          <Option name="prolog_script"></Option>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
+          <Option name="sshArgs"></Option>
+          <Option name="use_numeric_log_levels">False</Option>
+          <Option name="use_tables">True</Option>
+        </FirewallOptions>
+      </Firewall>
     </ObjectGroup>
     <IntervalGroup id="stdid11_1" name="Time"/>
     <ObjectRef ref="id483F5B7623190"/>
@@ -11441,120 +11843,26 @@
     <ObjectRef ref="id4848F1D320246"/>
     <ObjectRef ref="id4848F1D420246"/>
   </Library>
-  <Library id="sysid99" name="Deleted Objects" ro="False">
-    <ObjectRef ref="host-hostB"/>
-    <Library color="#FFFFFF" comment="" id="id40E233F3" name="West Coast" ro="False">
-      <ObjectGroup id="id40E233F4" name="Objects">
-        <ObjectGroup id="id40E233F4_og_ats_1" name="Address Tables"/>
-        <ObjectGroup id="id40E233F5" name="Addresses"/>
-        <ObjectGroup id="id40E233F6" name="Groups">
-          <ObjectGroup comment="" id="id40E23403" name="West Coast Servers"/>
-        </ObjectGroup>
-        <ObjectGroup id="id40E233F7" name="Hosts"/>
-        <ObjectGroup id="id40E233F8" name="Networks"/>
-        <ObjectGroup id="id40E233F9" name="Address Ranges"/>
-      </ObjectGroup>
-      <ServiceGroup id="id40E233FA" name="Services">
-        <ServiceGroup id="id40E233FA_og_tag_1" name="TagServices"/>
-        <ServiceGroup id="id40E233FB" name="Groups"/>
-        <ServiceGroup id="id40E233FC" name="ICMP"/>
-        <ServiceGroup id="id40E233FD" name="IP"/>
-        <ServiceGroup id="id40E233FE" name="TCP"/>
-        <ServiceGroup id="id40E233FF" name="UDP"/>
-        <ServiceGroup id="id40E23400" name="Custom"/>
-        <ServiceGroup id="id40E233FA_userservices" name="Users"/>
-      </ServiceGroup>
-      <ObjectGroup id="id40E23401" name="Firewalls"/>
-      <IntervalGroup id="id40E23402" name="Time"/>
-    </Library>
-    <Library color="#FFFFFF" comment="" id="id40D07E7A" name="LAX" ro="False">
-      <ObjectGroup id="id40D07E7B" name="Objects">
-        <ObjectGroup id="id40D07E7B_og_ats_1" name="Address Tables"/>
-        <ObjectGroup id="id40D07E7C" name="Addresses">
-          <IPv4 comment="" id="id40E238E6" name="laxftp1" address="10.1.10.10" netmask="255.255.255.255"/>
-          <IPv4 comment="" id="id40E238E7" name="laxweb1" address="10.1.10.11" netmask="255.255.255.255"/>
-        </ObjectGroup>
-        <ObjectGroup id="id40D07E7D" name="Groups">
-          <ObjectGroup comment="" id="id40E23565" name="LAX Servers"/>
-        </ObjectGroup>
-        <ObjectGroup id="id40D07E7E" name="Hosts"/>
-        <ObjectGroup id="id40D07E7F" name="Networks"/>
-        <ObjectGroup id="id40D07E80" name="Address Ranges"/>
-      </ObjectGroup>
-      <ServiceGroup id="id40D07E81" name="Services">
-        <ServiceGroup id="id40D07E81_og_tag_1" name="TagServices"/>
-        <ServiceGroup id="id40D07E82" name="Groups"/>
-        <ServiceGroup id="id40D07E83" name="ICMP"/>
-        <ServiceGroup id="id40D07E84" name="IP"/>
-        <ServiceGroup id="id40D07E85" name="TCP"/>
-        <ServiceGroup id="id40D07E86" name="UDP"/>
-        <ServiceGroup id="id40D07E87" name="Custom"/>
-        <ServiceGroup id="id40D07E81_userservices" name="Users"/>
-      </ServiceGroup>
-      <ObjectGroup id="id40D07E88" name="Firewalls"/>
-      <IntervalGroup id="id40D07E89" name="Time"/>
-    </Library>
-    <Library color="#FFFFFF" comment="" id="id40C3E07E" name="SFO" ro="False">
-      <ObjectGroup id="id40C3E07F" name="Objects">
-        <ObjectGroup id="id40C3E07F_og_ats_1" name="Address Tables"/>
-        <ObjectGroup id="id40C3E081" name="Groups">
-          <ObjectGroup comment="" id="id40E23562" name="SFO Servers"/>
-        </ObjectGroup>
-        <ObjectGroup id="id40C3E080" name="Addresses">
-          <IPv4 comment="" id="id40E238E9" name="sfoweb1" address="10.2.10.11" netmask="255.255.255.255"/>
-          <IPv4 comment="" id="id40E238E8" name="sfoftp1" address="10.2.10.10" netmask="255.255.255.255"/>
-        </ObjectGroup>
-      </ObjectGroup>
-    </Library>
-    <Library color="#d2ffd0" comment="" id="id44EC13FB8791" name="tmp" ro="False">
-      <ObjectGroup id="id44EC13FC8791" name="Objects">
-        <ObjectGroup id="id44EC13FD8791" name="Addresses"/>
-        <ObjectGroup id="id44EC13FE8791" name="DNS Names"/>
-        <ObjectGroup id="id44EC13FF8791" name="Address Tables"/>
-        <ObjectGroup id="id44EC14008791" name="Groups"/>
-        <ObjectGroup id="id44EC14018791" name="Hosts"/>
-        <ObjectGroup id="id44EC14028791" name="Networks"/>
-        <ObjectGroup id="id44EC14038791" name="Address Ranges"/>
-      </ObjectGroup>
-      <ServiceGroup id="id44EC14048791" name="Services">
-        <ServiceGroup id="id44EC14058791" name="Groups"/>
-        <ServiceGroup id="id44EC14068791" name="ICMP"/>
-        <ServiceGroup id="id44EC14078791" name="IP"/>
-        <ServiceGroup id="id44EC14088791" name="TCP"/>
-        <ServiceGroup id="id44EC14098791" name="UDP"/>
-        <ServiceGroup id="id44EC140A8791" name="Custom"/>
-        <ServiceGroup id="id44EC140B8791" name="TagServices"/>
-        <ServiceGroup id="id44EC14048791_userservices" name="Users"/>
-      </ServiceGroup>
-      <ObjectGroup id="id44EC140C8791" name="Firewalls"/>
-      <IntervalGroup id="id44EC140D8791" name="Time"/>
-    </Library>
-    <AddressTable comment="" filename="/home/vadim/tmp/bug-1544488/addr-table-1.tbl" id="id44F7056328576" name="atbl" run_time="True"/>
-    <Interface bridgeport="False" comment="" dyn="False" id="id45DE9D012560" label="" mgmt="False" name="pcn1" security_level="100" unnum="False" unprotected="False">
-      <IPv4 comment="" id="id45DE9D032560" name="openbsd-4.0:pcn1:ip" address="10.1.1.1" netmask="255.255.255.0"/>
-    </Interface>
-    <Interface bridgeport="False" comment="" dyn="True" id="id4848A43B4626" label="" mgmt="False" name="ppp0" security_level="0" unnum="False" unprotected="False"/>
-  </Library>
-  <Library color="#FFFFFF" comment="" id="id415276C8" name="lab" ro="False">
+  <Library id="id415276C8" name="lab" color="#FFFFFF" ro="False">
     <ObjectGroup id="id415276C9" name="Objects">
       <ObjectGroup id="id415276C9_og_ats_1" name="Address Tables"/>
       <ObjectGroup id="id415276CA" name="Addresses">
-        <IPv4 comment="" id="id4144D59F" name="hst1" address="10.3.14.10" netmask="255.255.255.255"/>
-        <IPv4 comment="" id="id4144D5A0" name="hst2" address="10.3.14.40" netmask="255.255.255.255"/>
+        <IPv4 id="id4144D59F" name="hst1" address="10.3.14.10" netmask="255.255.255.255"/>
+        <IPv4 id="id4144D5A0" name="hst2" address="10.3.14.40" netmask="255.255.255.255"/>
       </ObjectGroup>
       <ObjectGroup id="id415276CB" name="Groups"/>
       <ObjectGroup id="id415276CC" name="Hosts"/>
       <ObjectGroup id="id415276CD" name="Networks">
-        <Network comment="" id="id414C5C51" name="n-10.3.14" address="10.3.14.0" netmask="255.255.255.0"/>
-        <Network comment="" id="id414C70BE" name="labnet" address="10.1.1.0" netmask="255.255.255.0"/>
-        <Network comment="" id="id414C7BA7" name="n-10.1.2" address="10.1.2.0" netmask="255.255.255.0"/>
+        <Network id="id414C5C51" name="n-10.3.14" address="10.3.14.0" netmask="255.255.255.0"/>
+        <Network id="id414C70BE" name="labnet" address="10.1.1.0" netmask="255.255.255.0"/>
+        <Network id="id414C7BA7" name="n-10.1.2" address="10.1.2.0" netmask="255.255.255.0"/>
       </ObjectGroup>
       <ObjectGroup id="id415276CE" name="Address Ranges"/>
       <ObjectGroup id="id4386458B18448" name="DNS Names"/>
     </ObjectGroup>
     <ServiceGroup id="id415276CF" name="Services">
       <ServiceGroup id="id415276CF_og_tag_1" name="TagServices">
-        <TagService comment="" id="id4847247323126" name="INTNET" tagcode="INTNET"/>
+        <TagService id="id4847247323126" name="INTNET" tagcode="INTNET"/>
       </ServiceGroup>
       <ServiceGroup id="id415276D0" name="Groups"/>
       <ServiceGroup id="id415276D1" name="ICMP"/>
@@ -11565,9 +11873,9 @@
       <ServiceGroup id="id415276CF_userservices" name="Users"/>
     </ServiceGroup>
     <ObjectGroup id="id415276D6" name="Firewalls">
-      <Firewall comment="firewall protects host it is running on&#10;&#10;Note that we set output file name to  /tmp/labfw.fw to test what compiler is going to do (since it generates three files rather than one), as well as to test installer in this case&#10;" host_OS="openbsd" id="id3AF5A2BA" inactive="False" lastCompiled="1172032243" lastInstalled="1172032344" lastModified="1212609898" name="labfw-openbsd" platform="pf" ro="False" version="">
+      <Firewall id="id3AF5A2BA" name="labfw-openbsd" comment="firewall protects host it is running on&#10;&#10;Note that we set output file name to  /tmp/labfw.fw to test what compiler is going to do (since it generates three files rather than one), as well as to test installer in this case&#10;" host_OS="openbsd" inactive="False" lastCompiled="1172032243" lastInstalled="1172032344" lastModified="1212609898" platform="pf" ro="False" version="">
         <NAT id="id3AF5A2BD" name="NAT">
-          <NATRule disabled="False" id="id414E693E" position="0">
+          <NATRule id="id414E693E" disabled="False" position="0">
             <OSrc neg="False">
               <ObjectRef ref="id414C70BE"/>
             </OSrc>
@@ -11588,7 +11896,7 @@
             </TSrv>
             <NATRuleOptions/>
           </NATRule>
-          <NATRule disabled="False" id="id414E7DF6" position="1">
+          <NATRule id="id414E7DF6" disabled="False" position="1">
             <OSrc neg="False">
               <ObjectRef ref="id414C70BE"/>
               <ObjectRef ref="id414C5C51"/>
@@ -11613,7 +11921,7 @@
           </NATRule>
         </NAT>
         <Policy id="id3AF5A2BC" name="Policy">
-          <PolicyRule action="Tag" direction="Both" disabled="False" group="" id="id48472A0C23126" log="False" position="0">
+          <PolicyRule id="id48472A0C23126" action="Tag" direction="Both" disabled="False" group="" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -11655,7 +11963,7 @@
               <Option name="tagobject_id">id4847247323126</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Inbound" disabled="False" id="id414C70C1" log="True" position="1">
+          <PolicyRule id="id414C70C1" action="Deny" direction="Inbound" disabled="False" log="True" position="1">
             <Src neg="False">
               <ObjectRef ref="id414C70BE"/>
               <ObjectRef ref="id414C7BA7"/>
@@ -11676,7 +11984,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Outbound" disabled="False" id="id414C47E4" log="True" position="2">
+          <PolicyRule id="id414C47E4" action="Deny" direction="Outbound" disabled="False" log="True" position="2">
             <Src neg="True">
               <ObjectRef ref="id3AF5A2BA"/>
               <ObjectRef ref="id414C70BE"/>
@@ -11697,7 +12005,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id41441D4F" log="False" position="3">
+          <PolicyRule id="id41441D4F" action="Accept" direction="Both" disabled="False" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -11715,7 +12023,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Branch" direction="Inbound" disabled="False" id="id445E76C726850" log="False" position="4">
+          <PolicyRule id="id445E76C726850" action="Branch" direction="Inbound" disabled="False" log="False" position="4">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -11737,7 +12045,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id414E7E0E" log="False" position="5">
+          <PolicyRule id="id414E7E0E" action="Accept" direction="Both" disabled="False" log="False" position="5">
             <Src neg="False">
               <ObjectRef ref="id414C5C51"/>
               <ObjectRef ref="id414C70BE"/>
@@ -11757,7 +12065,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="allow all outgoing connections" direction="Both" disabled="False" id="id3AF5A757" log="False" position="6">
+          <PolicyRule id="id3AF5A757" comment="allow all outgoing connections" action="Accept" direction="Both" disabled="False" log="False" position="6">
             <Src neg="False">
               <ObjectRef ref="id3AF5A2BA"/>
               <ObjectRef ref="id414C70BE"/>
@@ -11776,7 +12084,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Deny" comment="'catch all' rule" direction="Both" disabled="False" id="id3AF5A762" log="True" position="7">
+          <PolicyRule id="id3AF5A762" comment="'catch all' rule" action="Deny" direction="Both" disabled="False" log="True" position="7">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -11798,7 +12106,7 @@
           </PolicyRule>
         </Policy>
         <Policy id="id445E76D326850" name="rule3_branch">
-          <PolicyRule action="Deny" comment="block fragments" direction="Both" disabled="False" id="id445E77D326850" log="True" position="0">
+          <PolicyRule id="id445E77D326850" comment="block fragments" action="Deny" direction="Both" disabled="False" log="True" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -11818,7 +12126,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id445E77BB26850" log="False" position="1">
+          <PolicyRule id="id445E77BB26850" action="Accept" direction="Both" disabled="False" log="False" position="1">
             <Src neg="True">
               <ObjectRef ref="id4144D59F"/>
               <ObjectRef ref="id4144D5A0"/>
@@ -11845,14 +12153,14 @@
           </PolicyRule>
         </Policy>
         <Routing id="id3AF5A2BA-routing" name="Routing"/>
-        <Interface bridgeport="False" comment="" dyn="False" id="id3AF5A2CB" label="" mgmt="True" name="pcn0" security_level="0" unnum="False" unprotected="False">
-          <IPv4 comment="" id="id3AF5A2CB-ipv4" name="labfw-openbsd:pcn0:ip" address="10.3.14.120" netmask="255.255.255.0"/>
+        <Interface id="id3AF5A2CB" name="pcn0" bridgeport="False" dyn="False" label="" mgmt="True" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id3AF5A2CB-ipv4" name="labfw-openbsd:pcn0:ip" address="10.3.14.120" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" dyn="False" id="id3AFB7090" name="lo" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id3AFB7090" name="lo" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id3AFB7090-ipv4" name="labfw-openbsd:lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
-        <Interface bridgeport="False" comment="" dyn="False" id="id414C70BB" label="" mgmt="False" name="pcn1" security_level="100" unnum="False" unprotected="False">
-          <IPv4 comment="" id="id414C70BD" name="labfw-openbsd:pcn1:ip" address="10.1.1.1" netmask="255.255.255.0"/>
+        <Interface id="id414C70BB" name="pcn1" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id414C70BD" name="labfw-openbsd:pcn1:ip" address="10.1.1.1" netmask="255.255.255.0"/>
         </Interface>
         <Management address="10.3.14.120">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -11974,9 +12282,9 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall comment="" host_OS="freebsd" id="id42B5D8FC" inactive="True" lastCompiled="1157930826" lastInstalled="0" lastModified="1147032998" name="labfw-fbsd" platform="pf" ro="False" version="">
+      <Firewall id="id42B5D8FC" name="labfw-fbsd" host_OS="freebsd" inactive="True" lastCompiled="1157930826" lastInstalled="0" lastModified="1147032998" platform="pf" ro="False" version="">
         <NAT id="id42B5D93E" name="NAT">
-          <NATRule disabled="False" id="id42B5D93F" position="0">
+          <NATRule id="id42B5D93F" disabled="False" position="0">
             <OSrc neg="False">
               <ObjectRef ref="id414C70BE"/>
             </OSrc>
@@ -11999,7 +12307,7 @@
           </NATRule>
         </NAT>
         <Policy id="id42B5D901" name="Policy">
-          <PolicyRule action="Deny" direction="Inbound" disabled="False" id="id42B5D977" log="True" position="0">
+          <PolicyRule id="id42B5D977" action="Deny" direction="Inbound" disabled="False" log="True" position="0">
             <Src neg="False">
               <ObjectRef ref="id414C70BE"/>
               <ObjectRef ref="id42B5D8FC"/>
@@ -12020,7 +12328,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Outbound" disabled="False" id="id42B5D982" log="True" position="1">
+          <PolicyRule id="id42B5D982" action="Deny" direction="Outbound" disabled="False" log="True" position="1">
             <Src neg="True">
               <ObjectRef ref="id42B5D8FC"/>
               <ObjectRef ref="id414C70BE"/>
@@ -12041,7 +12349,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id42B5D99C" log="False" position="2">
+          <PolicyRule id="id42B5D99C" action="Accept" direction="Both" disabled="False" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -12059,7 +12367,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Deny" comment="block fragments" direction="Both" disabled="False" id="id42B5D902" log="True" position="3">
+          <PolicyRule id="id42B5D902" comment="block fragments" action="Deny" direction="Both" disabled="False" log="True" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -12079,7 +12387,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="need this because PF consults&#10;policy rules after nat as well" direction="Both" disabled="False" id="id42B5D929" log="False" position="4">
+          <PolicyRule id="id42B5D929" comment="need this because PF consults&#10;policy rules after nat as well" action="Accept" direction="Both" disabled="False" log="False" position="4">
             <Src neg="False">
               <ObjectRef ref="id42B5D8FC"/>
             </Src>
@@ -12097,7 +12405,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="allow all outgoing connections" direction="Both" disabled="False" id="id42B612DC" log="False" position="5">
+          <PolicyRule id="id42B612DC" comment="allow all outgoing connections" action="Accept" direction="Both" disabled="False" log="False" position="5">
             <Src neg="False">
               <ObjectRef ref="id414C70BE"/>
             </Src>
@@ -12115,7 +12423,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Deny" comment="'catch all' rule" direction="Both" disabled="False" id="id42B5D934" log="True" position="6">
+          <PolicyRule id="id42B5D934" comment="'catch all' rule" action="Deny" direction="Both" disabled="False" log="True" position="6">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -12137,14 +12445,14 @@
           </PolicyRule>
         </Policy>
         <Routing id="id42B5D8FC-routing" name="Routing"/>
-        <Interface bridgeport="False" comment="" dyn="False" id="id42B5D95D" label="" mgmt="True" name="lnc0" security_level="0" unnum="False" unprotected="False">
-          <IPv4 comment="" id="id42B5D98D" name="labfw-fbsd:lnc0:ip" address="10.3.14.121" netmask="255.255.255.0"/>
+        <Interface id="id42B5D95D" name="lnc0" bridgeport="False" dyn="False" label="" mgmt="True" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id42B5D98D" name="labfw-fbsd:lnc0:ip" address="10.3.14.121" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" comment="" dyn="False" id="id42B5D98E" label="" mgmt="False" name="lo0" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id42B5D98E" name="lo0" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id42B5D9A6" name="labfw-fbsd:lo0:ip" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
-        <Interface bridgeport="False" comment="" dyn="False" id="id42B5D9A7" label="" mgmt="False" name="lnc1" security_level="100" unnum="False" unprotected="False">
-          <IPv4 comment="" id="id42B5D9AB" name="labfw-fbsd:lnc1:ip" address="10.1.1.1" netmask="255.255.255.0"/>
+        <Interface id="id42B5D9A7" name="lnc1" bridgeport="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id42B5D9AB" name="labfw-fbsd:lnc1:ip" address="10.1.1.1" netmask="255.255.255.0"/>
         </Interface>
         <Management address="10.3.14.121">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -12272,10 +12580,10 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall comment="firewall protects host it is running on&#10;&#10;Note that we set output file name to  /tmp/labfw.fw to test what compiler is going to do (since it generates three files rather than one), as well as to test installer in this case&#10;" host_OS="openbsd" id="id45DE9C5B2560" inactive="False" lastCompiled="1202683169" lastInstalled="1202683190" lastModified="1202683163" name="openbsd-4.0" platform="pf" ro="False" version="ge_3.7">
+      <Firewall id="id45DE9C5B2560" name="openbsd-4.0" comment="firewall protects host it is running on&#10;&#10;Note that we set output file name to  /tmp/labfw.fw to test what compiler is going to do (since it generates three files rather than one), as well as to test installer in this case&#10;" host_OS="openbsd" inactive="False" lastCompiled="1202683169" lastInstalled="1202683190" lastModified="1202683163" platform="pf" ro="False" version="ge_3.7">
         <NAT id="id45DE9CDB2560" name="NAT"/>
         <Policy id="id45DE9C612560" name="Policy">
-          <PolicyRule action="Accept" direction="Both" disabled="True" id="id47B0069F19082" log="False" position="0">
+          <PolicyRule id="id47B0069F19082" action="Accept" direction="Both" disabled="True" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="id4144D5A0"/>
             </Src>
@@ -12295,7 +12603,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Outbound" disabled="False" id="id45DE9C6F2560" log="True" position="1">
+          <PolicyRule id="id45DE9C6F2560" action="Deny" direction="Outbound" disabled="False" log="True" position="1">
             <Src neg="True">
               <ObjectRef ref="id45DE9C5B2560"/>
             </Src>
@@ -12315,7 +12623,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id45DE9C7C2560" log="False" position="2">
+          <PolicyRule id="id45DE9C7C2560" action="Accept" direction="Both" disabled="False" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -12333,7 +12641,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Branch" direction="Inbound" disabled="False" id="id45DE9C882560" log="False" position="3">
+          <PolicyRule id="id45DE9C882560" action="Branch" direction="Inbound" disabled="False" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -12355,7 +12663,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="allow all outgoing connections" direction="Both" disabled="False" id="id45DE9CC22560" log="False" position="4">
+          <PolicyRule id="id45DE9CC22560" comment="allow all outgoing connections" action="Accept" direction="Both" disabled="False" log="False" position="4">
             <Src neg="False">
               <ObjectRef ref="id45DE9C5B2560"/>
             </Src>
@@ -12373,7 +12681,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Deny" comment="'catch all' rule" direction="Both" disabled="False" id="id45DE9CCF2560" log="True" position="5">
+          <PolicyRule id="id45DE9CCF2560" comment="'catch all' rule" action="Deny" direction="Both" disabled="False" log="True" position="5">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -12395,7 +12703,7 @@
           </PolicyRule>
         </Policy>
         <Policy id="id45DE9C942560" name="rule3_branch">
-          <PolicyRule action="Deny" comment="block fragments" direction="Both" disabled="False" id="id45DE9C952560" log="True" position="0">
+          <PolicyRule id="id45DE9C952560" comment="block fragments" action="Deny" direction="Both" disabled="False" log="True" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -12415,7 +12723,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id45DE9CA12560" log="False" position="1">
+          <PolicyRule id="id45DE9CA12560" action="Accept" direction="Both" disabled="False" log="False" position="1">
             <Src neg="True">
               <ObjectRef ref="id4144D59F"/>
               <ObjectRef ref="id4144D5A0"/>
@@ -12442,10 +12750,10 @@
           </PolicyRule>
         </Policy>
         <Routing id="id45DE9CFA2560" name="Routing"/>
-        <Interface bridgeport="False" comment="" dyn="False" id="id45DE9CFB2560" label="" mgmt="True" name="pcn0" security_level="0" unnum="False" unprotected="False">
-          <IPv4 comment="" id="id45DE9CFD2560" name="openbsd-4.0:pcn0:ip" address="10.3.14.54" netmask="255.255.255.0"/>
+        <Interface id="id45DE9CFB2560" name="pcn0" bridgeport="False" dyn="False" label="" mgmt="True" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id45DE9CFD2560" name="openbsd-4.0:pcn0:ip" address="10.3.14.54" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" dyn="False" id="id45DE9CFE2560" name="lo" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id45DE9CFE2560" name="lo" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id45DE9D002560" name="openbsd-4.0:lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
         <Management address="10.3.14.54">
@@ -12568,10 +12876,10 @@
           <Option name="use_tables">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall comment="firewall protects host it is running on&#10;&#10;Note that we set output file name to  /tmp/labfw.fw to test what compiler is going to do (since it generates three files rather than one), as well as to test installer in this case&#10;" host_OS="openbsd" id="id47B07CD419082" inactive="False" lastCompiled="1202686003" lastInstalled="1202686020" lastModified="1202685992" name="openbsd-4.2" platform="pf" ro="False" version="4.x">
+      <Firewall id="id47B07CD419082" name="openbsd-4.2" comment="firewall protects host it is running on&#10;&#10;Note that we set output file name to  /tmp/labfw.fw to test what compiler is going to do (since it generates three files rather than one), as well as to test installer in this case&#10;" host_OS="openbsd" inactive="False" lastCompiled="1202686003" lastInstalled="1202686020" lastModified="1202685992" platform="pf" ro="False" version="4.x">
         <NAT id="id47B07D4319082" name="NAT"/>
         <Policy id="id47B07CDA19082" name="Policy">
-          <PolicyRule action="Accept" direction="Both" disabled="True" id="id47B07CDB19082" log="False" position="0">
+          <PolicyRule id="id47B07CDB19082" action="Accept" direction="Both" disabled="True" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="id4144D5A0"/>
             </Src>
@@ -12591,7 +12899,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Deny" direction="Outbound" disabled="False" id="id47B07CE719082" log="True" position="1">
+          <PolicyRule id="id47B07CE719082" action="Deny" direction="Outbound" disabled="False" log="True" position="1">
             <Src neg="True">
               <ObjectRef ref="id47B07CD419082"/>
             </Src>
@@ -12611,7 +12919,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" direction="Both" disabled="False" id="id47B07CF319082" log="False" position="2">
+          <PolicyRule id="id47B07CF319082" action="Accept" direction="Both" disabled="False" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -12629,7 +12937,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Branch" direction="Inbound" disabled="False" id="id47B07CFF19082" log="False" position="3">
+          <PolicyRule id="id47B07CFF19082" action="Branch" direction="Inbound" disabled="False" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -12651,7 +12959,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="allow all outgoing connections" direction="Both" disabled="False" id="id47B07D2B19082" log="False" position="4">
+          <PolicyRule id="id47B07D2B19082" comment="allow all outgoing connections" action="Accept" direction="Both" disabled="False" log="False" position="4">
             <Src neg="False">
               <ObjectRef ref="id47B07CD419082"/>
             </Src>
@@ -12669,7 +12977,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule action="Deny" comment="'catch all' rule" direction="Both" disabled="False" id="id47B07D3719082" log="True" position="5">
+          <PolicyRule id="id47B07D3719082" comment="'catch all' rule" action="Deny" direction="Both" disabled="False" log="True" position="5">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -12691,7 +12999,7 @@
           </PolicyRule>
         </Policy>
         <Policy id="id47B07D0B19082" name="rule3_branch">
-          <PolicyRule action="Deny" comment="block fragments" direction="Both" disabled="False" id="id47B07D0C19082" log="True" position="0">
+          <PolicyRule id="id47B07D0C19082" comment="block fragments" action="Deny" direction="Both" disabled="False" log="True" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -12711,7 +13019,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id47B07D1819082" log="False" position="1">
+          <PolicyRule id="id47B07D1819082" action="Accept" direction="Both" disabled="False" log="False" position="1">
             <Src neg="True">
               <ObjectRef ref="id4144D59F"/>
               <ObjectRef ref="id4144D5A0"/>
@@ -12738,10 +13046,10 @@
           </PolicyRule>
         </Policy>
         <Routing id="id47B07D4419082" name="Routing"/>
-        <Interface bridgeport="False" comment="" dyn="False" id="id47B07D4519082" label="" mgmt="True" name="pcn0" security_level="0" unnum="False" unprotected="False">
-          <IPv4 comment="" id="id47B07D4719082" name="openbsd-4.2:pcn0:ip" address="10.3.14.50" netmask="255.255.255.0"/>
+        <Interface id="id47B07D4519082" name="pcn0" bridgeport="False" dyn="False" label="" mgmt="True" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id47B07D4719082" name="openbsd-4.2:pcn0:ip" address="10.3.14.50" netmask="255.255.255.0"/>
         </Interface>
-        <Interface bridgeport="False" dyn="False" id="id47B07D4819082" name="lo" security_level="100" unnum="False" unprotected="False">
+        <Interface id="id47B07D4819082" name="lo" bridgeport="False" dyn="False" security_level="100" unnum="False" unprotected="False">
           <IPv4 id="id47B07D4A19082" name="openbsd-4.2:lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
         <Management address="10.3.14.50">
@@ -12873,7 +13181,7 @@
     </ObjectGroup>
     <IntervalGroup id="id415276D7" name="Time"/>
   </Library>
-  <Library color="#FFFFFF" comment="" id="id4387B43718346" name="transfer" ro="False">
+  <Library id="id4387B43718346" name="transfer" color="#FFFFFF" ro="False">
     <ObjectGroup id="id4387B43818346" name="Objects">
       <ObjectGroup id="id4387B43918346" name="Addresses"/>
       <ObjectGroup id="id4387B43A18346" name="DNS Names"/>
@@ -12896,63 +13204,63 @@
     <ObjectGroup id="id4387B44718346" name="Firewalls"/>
     <IntervalGroup id="id4387B44818346" name="Time"/>
   </Library>
-  <Library color="#d4f8ff" comment="Standard objects" id="syslib000" name="Standard" ro="True">
+  <Library id="syslib000" name="Standard" comment="Standard objects" color="#d4f8ff" ro="True">
     <ServiceGroup id="stdid05" name="Services">
       <ServiceGroup id="stdid06" name="IP">
-        <IPService comment="IPSEC Encapsulating Security Payload Protocol" fragm="False" id="ip-IPSEC" lsrr="False" name="ESP" protocol_num="50" rr="False" short_fragm="False" ssrr="False" ts="False"/>
-        <IPService comment="'Short' fragments" fragm="False" id="ip-IP_Fragments" lsrr="False" name="ip_fragments" protocol_num="0" rr="False" short_fragm="True" ssrr="False" ts="False"/>
-        <IPService comment="Route recording packets" fragm="False" id="ip-RR" lsrr="False" name="RR" protocol_num="0" rr="True" short_fragm="False" ssrr="False" ts="False"/>
-        <IPService comment="All sorts of Source Routing Packets" fragm="False" id="ip-SRR" lsrr="True" name="SRR" protocol_num="0" rr="False" short_fragm="False" ssrr="True" ts="False"/>
-        <IPService comment="Generic Routing Encapsulation&#10;" fragm="False" id="id3D703C8F" lsrr="False" name="GRE" protocol_num="47" rr="False" short_fragm="False" ssrr="False" ts="False"/>
-        <IPService comment="IPSEC Authentication Header Protocol" fragm="False" id="id3CB12797" lsrr="False" name="AH" protocol_num="51" rr="False" short_fragm="False" ssrr="False" ts="False"/>
+        <IPService id="ip-IP_Fragments" name="ip_fragments" comment="'Short' fragments" fragm="False" lsrr="False" protocol_num="0" rr="False" short_fragm="True" ssrr="False" ts="False"/>
+        <IPService id="ip-IPSEC" name="ESP" comment="IPSEC Encapsulating Security Payload Protocol" fragm="False" lsrr="False" protocol_num="50" rr="False" short_fragm="False" ssrr="False" ts="False"/>
+        <IPService id="ip-RR" name="RR" comment="Route recording packets" fragm="False" lsrr="False" protocol_num="0" rr="True" short_fragm="False" ssrr="False" ts="False"/>
+        <IPService id="ip-SRR" name="SRR" comment="All sorts of Source Routing Packets" fragm="False" lsrr="True" protocol_num="0" rr="False" short_fragm="False" ssrr="True" ts="False"/>
+        <IPService id="id3D703C8F" name="GRE" comment="Generic Routing Encapsulation&#10;" fragm="False" lsrr="False" protocol_num="47" rr="False" short_fragm="False" ssrr="False" ts="False"/>
+        <IPService id="id3CB12797" name="AH" comment="IPSEC Authentication Header Protocol" fragm="False" lsrr="False" protocol_num="51" rr="False" short_fragm="False" ssrr="False" ts="False"/>
       </ServiceGroup>
       <ServiceGroup id="stdid09" name="TCP">
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="113" dst_range_start="113" fin_flag="False" fin_flag_mask="False" id="tcp-Auth" name="auth" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="53" dst_range_start="53" fin_flag="False" fin_flag_mask="False" id="tcp-DNS_zone_transf" name="dns-tcp" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="21" dst_range_start="21" fin_flag="False" fin_flag_mask="False" id="tcp-FTP" name="ftp" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="80" dst_range_start="80" fin_flag="False" fin_flag_mask="False" id="tcp-HTTP" name="http" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="119" dst_range_start="119" fin_flag="False" fin_flag_mask="False" id="tcp-NNTP" name="nntp" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="25" dst_range_start="25" fin_flag="False" fin_flag_mask="False" id="tcp-SMTP" name="smtp" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="22" dst_range_start="22" fin_flag="False" fin_flag_mask="False" id="tcp-SSH" name="ssh" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="23" dst_range_start="23" fin_flag="False" fin_flag_mask="False" id="tcp-Telnet" name="telnet" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="540" dst_range_start="540" fin_flag="False" fin_flag_mask="False" id="tcp-uucp" name="uucp" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="13" dst_range_start="13" fin_flag="False" fin_flag_mask="False" id="id3AEDBE6E" name="daytime" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="2105" dst_range_start="2105" fin_flag="False" fin_flag_mask="False" id="id3B4FEDA3" name="eklogin" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="443" dst_range_start="443" fin_flag="False" fin_flag_mask="False" id="id3B4FED69" name="https" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="143" dst_range_start="143" fin_flag="False" fin_flag_mask="False" id="id3AECF776" name="imap" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="993" dst_range_start="993" fin_flag="False" fin_flag_mask="False" id="id3B4FED9F" name="imaps" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="6667" dst_range_start="6667" fin_flag="False" fin_flag_mask="False" id="id3B4FF13C" name="irc" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="543" dst_range_start="543" fin_flag="False" fin_flag_mask="False" id="id3B4FEE21" name="klogin" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="544" dst_range_start="544" fin_flag="False" fin_flag_mask="False" id="id3B4FEE23" name="ksh" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="389" dst_range_start="389" fin_flag="False" fin_flag_mask="False" id="id3AECF778" name="ldap" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="98" dst_range_start="98" fin_flag="False" fin_flag_mask="False" id="id3B4FF000" name="linuxconf" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="3306" dst_range_start="3306" fin_flag="False" fin_flag_mask="False" id="id3B4FEEEE" name="mysql" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="2049" dst_range_start="2049" fin_flag="False" fin_flag_mask="False" id="id3B4FEE7A" name="nfs" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="110" dst_range_start="110" fin_flag="False" fin_flag_mask="False" id="id3B4FEE1D" name="pop3" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="5432" dst_range_start="5432" fin_flag="False" fin_flag_mask="False" id="id3B4FF0EA" name="postgres" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="515" dst_range_start="515" fin_flag="False" fin_flag_mask="False" id="id3AECF782" name="printer" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="26000" dst_range_start="26000" fin_flag="False" fin_flag_mask="False" id="id3B4FEF7C" name="quake" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="512" dst_range_start="512" fin_flag="False" fin_flag_mask="False" id="id3AECF77A" name="rexec" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="513" dst_range_start="513" fin_flag="False" fin_flag_mask="False" id="id3AECF77C" name="rlogin" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="514" dst_range_start="514" fin_flag="False" fin_flag_mask="False" id="id3AECF77E" name="rshell" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="4321" dst_range_start="4321" fin_flag="False" fin_flag_mask="False" id="id3B4FEF34" name="rwhois" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="465" dst_range_start="465" fin_flag="False" fin_flag_mask="False" id="id3B4FF04C" name="smtps" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="1080" dst_range_start="1080" fin_flag="False" fin_flag_mask="False" id="id3B4FEE76" name="socks" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="111" dst_range_start="111" fin_flag="False" fin_flag_mask="False" id="id3AEDBE00" name="sunrpc" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="7100" dst_range_start="7100" fin_flag="False" fin_flag_mask="False" id="id3B4FF1B8" name="xfs" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="True" comment="" dst_range_end="0" dst_range_start="0" fin_flag="False" fin_flag_mask="True" id="tcp-TCP-SYN" name="tcp-syn" psh_flag="False" psh_flag_mask="True" rst_flag="False" rst_flag_mask="True" src_range_end="0" src_range_start="0" syn_flag="True" syn_flag_mask="True" urg_flag="False" urg_flag_mask="True"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="FTP data channel.&#10;  Note: FTP protocol does not really require server to use source port 20 for the data channel, &#10;  but many ftp server implementations do so." dst_range_end="65535" dst_range_start="1024" fin_flag="False" fin_flag_mask="False" id="tcp-FTP_data" name="ftp data" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="20" src_range_start="20" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="3128" dst_range_start="3128" fin_flag="False" fin_flag_mask="False" id="id3B4FF09A" name="squid" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="0" dst_range_start="0" fin_flag="False" fin_flag_mask="False" id="tcp-All_TCP" name="All TCP" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="53" dst_range_start="53" fin_flag="False" fin_flag_mask="False" id="tcp-DNS" name="domain" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
+        <TCPService id="tcp-Auth" name="auth" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="113" dst_range_end="113"/>
+        <TCPService id="tcp-DNS_zone_transf" name="dns-tcp" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="53" dst_range_end="53"/>
+        <TCPService id="tcp-FTP" name="ftp" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="21" dst_range_end="21"/>
+        <TCPService id="tcp-HTTP" name="http" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="80" dst_range_end="80"/>
+        <TCPService id="tcp-NNTP" name="nntp" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="119" dst_range_end="119"/>
+        <TCPService id="tcp-SMTP" name="smtp" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="25" dst_range_end="25"/>
+        <TCPService id="tcp-SSH" name="ssh" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="22" dst_range_end="22"/>
+        <TCPService id="tcp-Telnet" name="telnet" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="23" dst_range_end="23"/>
+        <TCPService id="tcp-uucp" name="uucp" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="540" dst_range_end="540"/>
+        <TCPService id="id3AEDBE6E" name="daytime" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="13" dst_range_end="13"/>
+        <TCPService id="id3B4FEDA3" name="eklogin" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="2105" dst_range_end="2105"/>
+        <TCPService id="id3B4FED69" name="https" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="443" dst_range_end="443"/>
+        <TCPService id="id3AECF776" name="imap" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="143" dst_range_end="143"/>
+        <TCPService id="id3B4FED9F" name="imaps" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="993" dst_range_end="993"/>
+        <TCPService id="id3B4FF13C" name="irc" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="6667" dst_range_end="6667"/>
+        <TCPService id="id3B4FEE21" name="klogin" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="543" dst_range_end="543"/>
+        <TCPService id="id3B4FEE23" name="ksh" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="544" dst_range_end="544"/>
+        <TCPService id="id3AECF778" name="ldap" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="389" dst_range_end="389"/>
+        <TCPService id="id3B4FF000" name="linuxconf" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="98" dst_range_end="98"/>
+        <TCPService id="id3B4FEEEE" name="mysql" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="3306" dst_range_end="3306"/>
+        <TCPService id="id3B4FEE7A" name="nfs" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="2049" dst_range_end="2049"/>
+        <TCPService id="id3B4FEE1D" name="pop3" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="110" dst_range_end="110"/>
+        <TCPService id="id3B4FF0EA" name="postgres" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="5432" dst_range_end="5432"/>
+        <TCPService id="id3AECF782" name="printer" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="515" dst_range_end="515"/>
+        <TCPService id="id3B4FEF7C" name="quake" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="26000" dst_range_end="26000"/>
+        <TCPService id="id3AECF77A" name="rexec" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="512" dst_range_end="512"/>
+        <TCPService id="id3AECF77C" name="rlogin" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="513" dst_range_end="513"/>
+        <TCPService id="id3AECF77E" name="rshell" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="514" dst_range_end="514"/>
+        <TCPService id="id3B4FEF34" name="rwhois" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="4321" dst_range_end="4321"/>
+        <TCPService id="id3B4FF04C" name="smtps" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="465" dst_range_end="465"/>
+        <TCPService id="id3B4FEE76" name="socks" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="1080" dst_range_end="1080"/>
+        <TCPService id="id3AEDBE00" name="sunrpc" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="111" dst_range_end="111"/>
+        <TCPService id="id3B4FF1B8" name="xfs" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="7100" dst_range_end="7100"/>
+        <TCPService id="tcp-TCP-SYN" name="tcp-syn" ack_flag="False" ack_flag_mask="True" fin_flag="False" fin_flag_mask="True" psh_flag="False" psh_flag_mask="True" rst_flag="False" rst_flag_mask="True" syn_flag="True" syn_flag_mask="True" urg_flag="False" urg_flag_mask="True" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
+        <TCPService id="tcp-FTP_data" name="ftp data" comment="FTP data channel.&#10;  Note: FTP protocol does not really require server to use source port 20 for the data channel, &#10;  but many ftp server implementations do so." ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="20" src_range_end="20" dst_range_start="1024" dst_range_end="65535"/>
+        <TCPService id="id3B4FF09A" name="squid" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="3128" dst_range_end="3128"/>
+        <TCPService id="tcp-All_TCP" name="All TCP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
+        <TCPService id="tcp-DNS" name="domain" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" src_range_start="0" src_range_end="0" dst_range_start="53" dst_range_end="53"/>
       </ServiceGroup>
       <ServiceGroup id="stdid08" name="UDP">
-        <UDPService comment="" dst_range_end="53" dst_range_start="53" id="udp-DNS" name="domain" src_range_end="0" src_range_start="0"/>
-        <UDPService comment="" dst_range_end="0" dst_range_start="0" id="udp-All_UDP" name="All UDP" src_range_end="0" src_range_start="0"/>
-        <UDPService comment="" dst_range_end="68" dst_range_start="68" id="udp-bootpc" name="bootpc" src_range_end="0" src_range_start="0"/>
+        <UDPService id="udp-DNS" name="domain" src_range_start="0" src_range_end="0" dst_range_start="53" dst_range_end="53"/>
+        <UDPService id="udp-All_UDP" name="All UDP" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
+        <UDPService id="udp-bootpc" name="bootpc" src_range_start="0" src_range_end="0" dst_range_start="68" dst_range_end="68"/>
       </ServiceGroup>
       <ServiceGroup id="stdid10" name="Groups">
-        <ServiceGroup comment="" id="sg-Useful_ICMP" name="Useful_ICMP">
+        <ServiceGroup id="sg-Useful_ICMP" name="Useful_ICMP">
           <ServiceRef ref="icmp-Time_exceeded"/>
           <ServiceRef ref="icmp-Time_exceeded_in_transit"/>
           <ServiceRef ref="icmp-ping_reply"/>
@@ -12968,25 +13276,25 @@
         </ServiceGroup>
       </ServiceGroup>
       <ServiceGroup id="stdid07" name="ICMP">
-        <ICMPService code="0" comment="" id="icmp-ping_request" name="ping request" type="8"/>
-        <ICMPService code="-1" comment="" id="icmp-Unreachables" name="all ICMP unreachables" type="3"/>
-        <ICMPService code="-1" comment="" id="id3C20EEB5" name="any ICMP" type="-1"/>
-        <ICMPService code="0" comment="ICMP messages of this type are needed for traceroute" id="icmp-Time_exceeded" name="time exceeded" type="11"/>
-        <ICMPService code="1" comment="" id="icmp-Time_exceeded_in_transit" name="time exceeded in transit" type="11"/>
-        <ICMPService code="0" comment="" id="icmp-ping_reply" name="ping reply" type="0"/>
+        <ICMPService id="icmp-ping_request" name="ping request" code="0" type="8"/>
+        <ICMPService id="icmp-Unreachables" name="all ICMP unreachables" code="-1" type="3"/>
+        <ICMPService id="id3C20EEB5" name="any ICMP" code="-1" type="-1"/>
+        <ICMPService id="icmp-Time_exceeded" name="time exceeded" comment="ICMP messages of this type are needed for traceroute" code="0" type="11"/>
+        <ICMPService id="icmp-Time_exceeded_in_transit" name="time exceeded in transit" code="1" type="11"/>
+        <ICMPService id="icmp-ping_reply" name="ping reply" code="0" type="0"/>
       </ServiceGroup>
     </ServiceGroup>
-    <AnyNetwork comment="Any Network" id="sysid0" name="Any" address="0.0.0.0" netmask="0.0.0.0"/>
-    <AnyInterval comment="Any Interval" days_of_week="0,1,2,3,4,5,6" from_day="-1" from_hour="-1" from_minute="-1" from_month="-1" from_weekday="-1" from_year="-1" id="sysid2" name="Any" to_day="-1" to_hour="-1" to_minute="-1" to_month="-1" to_weekday="-1" to_year="-1"/>
-    <AnyIPService comment="Any IP Service" id="sysid1" name="Any" protocol_num="0"/>
+    <AnyIPService id="sysid1" name="Any" comment="Any IP Service" protocol_num="0"/>
+    <AnyNetwork id="sysid0" name="Any" comment="Any Network" address="0.0.0.0" netmask="0.0.0.0"/>
+    <AnyInterval id="sysid2" name="Any" comment="Any Interval" days_of_week="0,1,2,3,4,5,6" from_day="-1" from_hour="-1" from_minute="-1" from_month="-1" from_weekday="-1" from_year="-1" to_day="-1" to_hour="-1" to_minute="-1" to_month="-1" to_weekday="-1" to_year="-1"/>
     <IntervalGroup id="stdid11" name="Time">
-      <Interval comment="any day 6:00pm - 12:00am" days_of_week="0,1,2,3,4,5,6" from_day="-1" from_hour="18" from_minute="0" from_month="-1" from_weekday="-1" from_year="-1" id="int-afterhours" name="afterhours" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="-1" to_year="-1"/>
-      <Interval comment="" days_of_week="6" from_day="-1" from_hour="0" from_minute="0" from_month="-1" from_weekday="6" from_year="-1" id="id3C63479C" name="Sat" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="6" to_year="-1"/>
-      <Interval comment="" days_of_week="0" from_day="-1" from_hour="0" from_minute="0" from_month="-1" from_weekday="0" from_year="-1" id="id3C63479E" name="Sun" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="0" to_year="-1"/>
+      <Interval id="int-afterhours" name="afterhours" comment="any day 6:00pm - 12:00am" days_of_week="0,1,2,3,4,5,6" from_day="-1" from_hour="18" from_minute="0" from_month="-1" from_weekday="-1" from_year="-1" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="-1" to_year="-1"/>
+      <Interval id="id3C63479C" name="Sat" days_of_week="6" from_day="-1" from_hour="0" from_minute="0" from_month="-1" from_weekday="6" from_year="-1" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="6" to_year="-1"/>
+      <Interval id="id3C63479E" name="Sun" days_of_week="0" from_day="-1" from_hour="0" from_minute="0" from_month="-1" from_weekday="0" from_year="-1" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="0" to_year="-1"/>
     </IntervalGroup>
     <ObjectGroup id="stdid01" name="Objects">
       <ObjectGroup id="stdid03" name="Networks">
-        <Network comment="192.168.1.0/24 - Address often used for home and small office networks.&#10;" id="id3DC75CE7-1" name="net-192.168.1.0" address="192.168.1.0" netmask="255.255.255.0"/>
+        <Network id="id3DC75CE7-1" name="net-192.168.1.0" comment="192.168.1.0/24 - Address often used for home and small office networks.&#10;" address="192.168.1.0" netmask="255.255.255.0"/>
       </ObjectGroup>
     </ObjectGroup>
   </Library>