From d36c466b8c8a2830b1370f16fa89137852065331 Mon Sep 17 00:00:00 2001
From: Vadim Kurland <vadim@netcitadel.com>
Date: Fri, 30 May 2008 02:51:31 +0000
Subject: [PATCH] can insert NetworkIPv6 into "Network" system group

---
 src/gui/FWBTree.cpp                       |     9 +-
 src/gui/ProjectPanel.cpp                  |     3 +-
 test/ipt/objects-for-regression-tests.fwb | 16294 ++++++++++++--------
 test/pf/objects-for-regression-tests.fwb  |    33 +-
 test/pf/quick-cmp.sh                      |     2 +-
 5 files changed, 9711 insertions(+), 6630 deletions(-)

diff --git a/src/gui/FWBTree.cpp b/src/gui/FWBTree.cpp
index c4262644a..e6bc23911 100644
--- a/src/gui/FWBTree.cpp
+++ b/src/gui/FWBTree.cpp
@@ -128,6 +128,9 @@ FWBTree::FWBTree()
     systemGroupTypes[Network::TYPENAME]=       ObjectGroup::TYPENAME;
     systemGroupNames[Network::TYPENAME]=       "Networks"       ;
 
+    systemGroupTypes[NetworkIPv6::TYPENAME]=   ObjectGroup::TYPENAME;
+    systemGroupNames[NetworkIPv6::TYPENAME]=   "Networks"       ;
+
     systemGroupTypes[IPv4::TYPENAME]=          ObjectGroup::TYPENAME;
     systemGroupNames[IPv4::TYPENAME]=          "Addresses"      ;
 
@@ -161,8 +164,8 @@ FWBTree::FWBTree()
     systemGroupTypes[UDPService::TYPENAME]=    ServiceGroup::TYPENAME;
     systemGroupNames[UDPService::TYPENAME]=    "UDP"           ;
 
-    systemGroupTypes[TagService::TYPENAME]=          ServiceGroup::TYPENAME;
-    systemGroupNames[TagService::TYPENAME]=          "TagService"           ;
+    systemGroupTypes[TagService::TYPENAME]=    ServiceGroup::TYPENAME;
+    systemGroupNames[TagService::TYPENAME]=    "TagService"    ;
 
     systemGroupTypes[ServiceGroup::TYPENAME]=  ServiceGroup::TYPENAME;
     systemGroupNames[ServiceGroup::TYPENAME]=  "Groups"        ;
@@ -334,7 +337,7 @@ bool FWBTree::isStandardId(FWObject *obj)
     return standardIDs[ obj->getId() ];
 }
 
-bool FWBTree::validateForInsertion(FWObject *target,FWObject *obj)
+bool FWBTree::validateForInsertion(FWObject *target, FWObject *obj)
 {
     if (fwbdebug) qDebug("FWBTree::validateForInsertion  target %s  obj %s",
                          target->getTypeName().c_str(),
diff --git a/src/gui/ProjectPanel.cpp b/src/gui/ProjectPanel.cpp
index 5ed394b31..571ab3e61 100644
--- a/src/gui/ProjectPanel.cpp
+++ b/src/gui/ProjectPanel.cpp
@@ -3546,7 +3546,8 @@ bool ProjectPanel::isStandardId(libfwbuilder::FWObject *obj)
     return objectTreeFormat->isStandardId(obj);
 }
     
-bool ProjectPanel::validateForInsertion(libfwbuilder::FWObject *target,libfwbuilder::FWObject *obj)
+bool ProjectPanel::validateForInsertion(libfwbuilder::FWObject *target,
+                                        libfwbuilder::FWObject *obj)
 {
     return objectTreeFormat->validateForInsertion(target, obj);
 }
diff --git a/test/ipt/objects-for-regression-tests.fwb b/test/ipt/objects-for-regression-tests.fwb
index c335b495f..b3a7fd59a 100644
--- a/test/ipt/objects-for-regression-tests.fwb
+++ b/test/ipt/objects-for-regression-tests.fwb
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
-<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="7" id="root">
+<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="7" lastModified="1212115906" id="root">
   <Library color="#d2ffd0" comment="User defined objects" id="syslib001" name="User">
     <ObjectGroup id="stdid01_1" name="Objects">
       <ObjectGroup id="stdid01_1_og_ats_1" name="Address Tables">
@@ -11,20 +11,22 @@
         <AddressTable comment="" filename="/home/vadim/Projects/fwb2.1/fwb2/fwbuilder2/test/ipt/emtpy-table.tbl" id="id459673BE7794" name="empty table" run_time="False"/>
       </ObjectGroup>
       <ObjectGroup id="stdid01_1_og_dnsn_1" name="DNS Names">
-        <DNSName comment="" dnsrec="www.cnn.com" id="id43869E8C18346" name="cnn (ct)" run_time="False"/>
-        <DNSName comment="" dnsrec="www.cnn.com" id="id43869E8D18346" name="cnn (rt)" run_time="True"/>
-        <DNSName comment="an example of a local host" dnsrec="buildmaster" id="id43869E8E18346" name="buildmaster (ct)" run_time="False"/>
-        <DNSName comment="an example of a local host" dnsrec="buildmaster" id="id43869E8F18346" name="buildmaster (rt)" run_time="True"/>
-        <DNSName comment="" dnsrec="www.google.com" id="id4387287918346" name="google (ct)" run_time="False"/>
-        <DNSName comment="" dnsrec="www.google.com" id="id4387287A18346" name="google (rt)" run_time="True"/>
-        <DNSName comment="" dnsrec="www.heise.de" id="id44EC181D8791" name="heise" run_time="True"/>
+        <DNSName comment="" dnsrec="www.cnn.com" dnsrectype="A" id="id43869E8C18346" name="cnn (ct)" run_time="False"/>
+        <DNSName comment="" dnsrec="www.cnn.com" dnsrectype="A" id="id43869E8D18346" name="cnn (rt)" run_time="True"/>
+        <DNSName comment="an example of a local host" dnsrec="buildmaster" dnsrectype="A" id="id43869E8E18346" name="buildmaster (ct)" run_time="False"/>
+        <DNSName comment="an example of a local host" dnsrec="buildmaster" dnsrectype="A" id="id43869E8F18346" name="buildmaster (rt)" run_time="True"/>
+        <DNSName comment="" dnsrec="www.google.com" dnsrectype="A" id="id4387287918346" name="google (ct)" run_time="False"/>
+        <DNSName comment="" dnsrec="www.google.com" dnsrectype="A" id="id4387287A18346" name="google (rt)" run_time="True"/>
+        <DNSName comment="" dnsrec="www.heise.de" dnsrectype="A" id="id44EC181D8791" name="heise" run_time="True"/>
       </ObjectGroup>
       <ObjectGroup id="stdid16_1" name="Addresses">
-        <IPv4 address="192.168.1.0" comment="" id="id417B3641" name="net_address" netmask="255.255.255.255"/>
-        <IPv4 address="61.150.47.112" comment="" id="id4388C37D674" name="sapmhost1" netmask="255.255.255.255"/>
-        <IPv4 address="0.0.0.0" comment="" id="id44C0695713221" name="this_host" netmask="255.255.255.255"/>
-        <IPv4 address="1.1.1.1" comment="" id="id44F7082928576" name="some address" netmask="255.255.255.255"/>
-        <IPv4 address="224.0.0.18" comment="" id="id45D61A0923626" name="VRRP" netmask="255.255.255.255"/>
+        <IPv4 comment="" id="id417B3641" name="net_address" address="192.168.1.0" netmask="255.255.255.255"/>
+        <IPv4 comment="" id="id4388C37D674" name="sapmhost1" address="61.150.47.112" netmask="255.255.255.255"/>
+        <IPv4 comment="" id="id44C0695713221" name="this_host" address="0.0.0.0" netmask="255.255.255.255"/>
+        <IPv4 comment="" id="id44F7082928576" name="some address" address="1.1.1.1" netmask="255.255.255.255"/>
+        <IPv4 comment="" id="id45D61A0923626" name="VRRP" address="224.0.0.18" netmask="255.255.255.255"/>
+        <IPv6 comment="" id="id483426D06131" name="ipv6-1" address="fe80::aaaa:bbbb:cccc:1" netmask="128"/>
+        <IPv6 comment="" id="id483426D16131" name="ipv6-2" address="fe80::aaaa:bbbb:cccc:2" netmask="128"/>
       </ObjectGroup>
       <ObjectGroup id="stdid04_1" name="Groups">
         <ObjectGroup id="id3B4572AF" name="group1">
@@ -107,11 +109,22 @@
           <ObjectRef ref="id43869E8D18346"/>
           <ObjectRef ref="id4387287A18346"/>
         </ObjectGroup>
+        <ObjectGroup comment="" id="id4834A2238571" name="ipv6 addresses">
+          <ObjectRef ref="id483426D06131"/>
+          <ObjectRef ref="id483426D16131"/>
+          <ObjectRef ref="id4834B9206131"/>
+        </ObjectGroup>
+        <ObjectGroup comment="" id="id4834A2278571" name="ipv4 ipv6 addresses">
+          <ObjectRef ref="id417B3641"/>
+          <ObjectRef ref="id483426D06131"/>
+          <ObjectRef ref="id483426D16131"/>
+          <ObjectRef ref="id4388C37D674"/>
+        </ObjectGroup>
       </ObjectGroup>
       <ObjectGroup id="stdid02_1" name="Hosts">
         <Host comment="multicast address which is _not_ local link multicast&#10;" id="id3A84EECE" name="DHCP-Servers (multicast)">
           <Interface bridgeport="False" dyn="False" id="id3D84EED2" name="interface1" security_level="0" unnum="False" unprotected="False">
-            <IPv4 address="224.0.1.141" id="id3D84EEDA" name="DHCP-Servers (multicast)" netmask="255.255.255.0"/>
+            <IPv4 id="id3D84EEDA" name="DHCP-Servers (multicast)" address="224.0.1.141" netmask="255.255.255.0"/>
           </Interface>
           <Management address="224.0.1.141">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -119,16 +132,16 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
         <Host comment="" id="id3CFBE20C" name="broadcast">
           <Interface bridgeport="False" dyn="False" id="id3CFBE20C-i" name="interface-1" security_level="0" unnum="False" unprotected="False">
-            <IPv4 address="255.255.255.255" comment="" id="id3CFBE20C-i-1-addr" name="broadcast:address" netmask="255.255.255.255"/>
+            <IPv4 comment="" id="id3CFBE20C-i-1-addr" name="broadcast:address" address="255.255.255.255" netmask="255.255.255.255"/>
           </Interface>
           <Management address="255.255.255.255">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -136,16 +149,16 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">False</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
         <Host comment="" id="id3D151943" name="dmzhost1">
           <Interface bridgeport="False" dyn="False" id="id3D151943-i" name="interface-1" security_level="0" unnum="False" unprotected="False">
-            <IPv4 address="192.168.2.10" id="id3D151943-i-1-addr" name="address" netmask="255.255.255.255"/>
+            <IPv4 id="id3D151943-i-1-addr" name="address" address="192.168.2.10" netmask="255.255.255.255"/>
           </Interface>
           <Management address="192.168.2.10">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -153,16 +166,16 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">False</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
         <Host comment="" id="id3D151947" name="dmzhost2">
           <Interface bridgeport="False" dyn="False" id="id3D151947-i" name="interface-1" security_level="0" unnum="False" unprotected="False">
-            <IPv4 address="192.168.2.11" id="id3D151947-i-1-addr" name="address" netmask="255.255.255.255"/>
+            <IPv4 id="id3D151947-i-1-addr" name="address" address="192.168.2.11" netmask="255.255.255.255"/>
           </Interface>
           <Management address="192.168.2.11">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -170,16 +183,16 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">False</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
         <Host comment="this host is used in firewall14" id="id3DE7223E" name="h-fw14-eth1-1">
           <Interface bridgeport="False" dyn="False" id="id3DE72244" name="interface1" security_level="0" unnum="False" unprotected="False">
-            <IPv4 address="22.22.23.22" comment="" id="id3DE72245" name="h-fw14-eth1-1" netmask="255.255.255.255"/>
+            <IPv4 comment="" id="id3DE72245" name="h-fw14-eth1-1" address="22.22.23.22" netmask="255.255.255.255"/>
           </Interface>
           <Management address="22.22.23.160">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -187,16 +200,16 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
         <Host comment="this host is used in firewall14" id="id3DE72236" name="h-fw14-eth1-2">
           <Interface bridgeport="False" dyn="False" id="id3DE7223A" name="interface1" security_level="0" unnum="False" unprotected="False">
-            <IPv4 address="22.22.23.160" comment="" id="id3DE7223B" name="h-fw14-eth1-2" netmask="255.255.255.255"/>
+            <IPv4 comment="" id="id3DE7223B" name="h-fw14-eth1-2" address="22.22.23.160" netmask="255.255.255.255"/>
           </Interface>
           <Management address="22.22.23.160">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -204,16 +217,16 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
         <Host comment="this host is used in firewall14" id="id3DE722F1" name="h-fw14-eth1-N">
           <Interface bridgeport="False" dyn="False" id="id3DE722F7" name="interface1" security_level="0" unnum="False" unprotected="False">
-            <IPv4 address="22.22.23.40" comment="" id="id3DE722F8" name="h-fw14-eth1-1" netmask="255.255.255.255"/>
+            <IPv4 comment="" id="id3DE722F8" name="h-fw14-eth1-1" address="22.22.23.40" netmask="255.255.255.255"/>
           </Interface>
           <Management address="22.22.23.22">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -221,16 +234,16 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
         <Host comment="this host has the same IP address as firewall1 and firewall2" id="id3AFC0F70" name="host-fw2">
           <Interface bridgeport="False" dyn="False" id="id3AFC0F70-i" name="unknown" security_level="100" unnum="False" unprotected="False">
-            <IPv4 address="22.22.22.22" id="id3AFC0F70-i-ipv4" name="address" netmask="255.255.255.255"/>
+            <IPv4 id="id3AFC0F70-i-ipv4" name="address" address="22.22.22.22" netmask="255.255.255.255"/>
           </Interface>
           <Management address="0.0.0.0">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -243,7 +256,7 @@
         </Host>
         <Host comment="" id="id3BF1B3E1" name="host-with-mac-1">
           <Interface bridgeport="False" comment="" dyn="False" id="id3BF1B3E2" label="" mgmt="False" name="host-with-mac-1:1" security_level="100" unnum="False" unprotected="False">
-            <IPv4 address="192.168.1.10" comment="" id="id3BF1B3E2-ipv4" name="host-with-mac-1/addr" netmask="255.255.255.0"/>
+            <IPv4 comment="" id="id3BF1B3E2-ipv4" name="host-with-mac-1/addr" address="192.168.1.10" netmask="255.255.255.0"/>
             <physAddress address="00:10:4b:de:e9:6f" id="id3BF1B3E2-pa" name="host-with-mac-1:1-pa"/>
           </Interface>
           <Management address="192.168.1.10">
@@ -252,9 +265,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr_filter">True</Option>
           </HostOptions>
         </Host>
@@ -268,9 +281,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr_filter">True</Option>
           </HostOptions>
         </Host>
@@ -284,9 +297,9 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr_filter">True</Option>
           </HostOptions>
         </Host>
@@ -300,15 +313,15 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr_filter">True</Option>
           </HostOptions>
         </Host>
         <Host comment="this host has an interface with both IP address and MAC address chld objects,&#10;but option &quot;turn on MAC address matching&quot; is NOT activated" id="id3E0F3FC8" name="host-with-mac-5">
           <Interface bridgeport="False" comment="" dyn="False" id="id3E0F3FC9" label="" mgmt="False" name="host-with-mac-5:1" security_level="100" unnum="False" unprotected="False">
-            <IPv4 address="192.168.1.15" comment="" id="id3E0F3FCA" name="host-with-mac-5/addr" netmask="255.255.255.0"/>
+            <IPv4 comment="" id="id3E0F3FCA" name="host-with-mac-5/addr" address="192.168.1.15" netmask="255.255.255.0"/>
             <physAddress address="aa:bb:cc:dd:ee:ff" comment="" id="id3E0F3FCB" name="host-with-mac-5:1-pa"/>
           </Interface>
           <Management address="192.168.1.15">
@@ -317,15 +330,15 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr_filter">True</Option>
           </HostOptions>
         </Host>
         <Host comment="" id="host-hostA" name="hostA">
           <Interface bridgeport="False" dyn="False" id="host-hostA-i" name="unknown" security_level="100" unnum="False" unprotected="False">
-            <IPv4 address="192.168.1.10" id="host-hostA-i-ipv4" name="address" netmask="255.255.255.255"/>
+            <IPv4 id="host-hostA-i-ipv4" name="address" address="192.168.1.10" netmask="255.255.255.255"/>
           </Interface>
           <Management address="192.168.1.10">
             <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -338,7 +351,7 @@
         </Host>
         <Host comment="translated address for hostA" id="id3AFADBF9" name="hostA-NAT">
           <Interface bridgeport="False" dyn="False" id="id3AFADBF9-i" name="unknown" security_level="100" unnum="False" unprotected="False">
-            <IPv4 address="22.22.22.23" id="id3AFADBF9-i-ipv4" name="address" netmask="255.255.255.255"/>
+            <IPv4 id="id3AFADBF9-i-ipv4" name="address" address="22.22.22.23" netmask="255.255.255.255"/>
           </Interface>
           <Management address="0.0.0.0">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -351,7 +364,7 @@
         </Host>
         <Host comment="" id="host-hostB" name="hostB">
           <Interface bridgeport="False" dyn="False" id="host-hostB-i" name="unknown" security_level="100" unnum="False" unprotected="False">
-            <IPv4 address="192.168.1.20" id="host-hostB-i-ipv4" name="address" netmask="255.255.255.255"/>
+            <IPv4 id="host-hostB-i-ipv4" name="address" address="192.168.1.20" netmask="255.255.255.255"/>
           </Interface>
           <Management address="192.168.1.20">
             <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -364,7 +377,7 @@
         </Host>
         <Host comment="" id="id3BD6736B" name="hostB-NAT">
           <Interface bridgeport="False" dyn="False" id="id3BD6736B-i" name="unknown" security_level="100" unnum="False" unprotected="False">
-            <IPv4 address="22.22.23.24" id="id3BD6736B-i-ipv4" name="address" netmask="255.255.255.255"/>
+            <IPv4 id="id3BD6736B-i-ipv4" name="address" address="22.22.23.24" netmask="255.255.255.255"/>
           </Interface>
           <HostOptions>
             <Option name="use_mac_addr_filter">false</Option>
@@ -372,7 +385,7 @@
         </Host>
         <Host comment="the same address as internal iface of firewall1" id="id3AFC191C" name="hostF-int">
           <Interface bridgeport="False" dyn="False" id="id3AFC191C-i" name="unknown" security_level="100" unnum="False" unprotected="False">
-            <IPv4 address="192.168.1.1" id="id3AFC191C-i-ipv4" name="address" netmask="255.255.255.255"/>
+            <IPv4 id="id3AFC191C-i-ipv4" name="address" address="192.168.1.1" netmask="255.255.255.255"/>
           </Interface>
           <Management address="0.0.0.0">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -385,8 +398,8 @@
         </Host>
         <Host comment="this host has multiple interfaces" id="id3DECF4EB" name="hostM-outside">
           <Interface bridgeport="False" comment="" dyn="False" id="id3DECF4EC" label="" mgmt="False" name="hostM-iface" security_level="100" unnum="False" unprotected="False">
-            <IPv4 address="222.222.222.40" comment="" id="id3DECF4ED" name="address" netmask="255.255.255.0"/>
-            <IPv4 address="222.222.222.41" comment="" id="id3DECF62C" name="hostM-outside" netmask="255.255.255.0"/>
+            <IPv4 comment="" id="id3DECF4ED" name="address" address="222.222.222.40" netmask="255.255.255.0"/>
+            <IPv4 comment="" id="id3DECF62C" name="hostM-outside" address="222.222.222.41" netmask="255.255.255.0"/>
           </Interface>
           <Management address="22.22.22.23">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -394,18 +407,18 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
         <Host comment="this host has multiple interfaces" id="id3DECF622" name="hostN-outside">
           <Interface bridgeport="False" dyn="False" id="id3DECF623" name="unknown" security_level="100" unnum="False" unprotected="False">
-            <IPv4 address="222.222.222.40" comment="" id="id3DECF624" name="address" netmask="255.255.255.0"/>
+            <IPv4 comment="" id="id3DECF624" name="address" address="222.222.222.40" netmask="255.255.255.0"/>
           </Interface>
           <Interface bridgeport="False" dyn="False" id="id3DECF62A" name="unknown" security_level="0" unnum="False" unprotected="False">
-            <IPv4 address="222.222.222.41" comment="" id="id3DECF62B" name="hostM-outside" netmask="255.255.255.0"/>
+            <IPv4 comment="" id="id3DECF62B" name="hostM-outside" address="222.222.222.41" netmask="255.255.255.0"/>
           </Interface>
           <Management address="222.222.222.41">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -413,21 +426,21 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
         <Host comment="host on subnet 22.22.22.0 with several addresses" id="id3DE47B6C" name="hostZ-outside">
           <Interface bridgeport="False" comment="" dyn="False" id="id3DE47B6D" label="" mgmt="False" name="eth0" security_level="100" unnum="False" unprotected="False">
-            <IPv4 address="22.22.22.23" comment="" id="id3DE47B6E" name="hZ-eth0" netmask="255.255.255.255"/>
+            <IPv4 comment="" id="id3DE47B6E" name="hZ-eth0" address="22.22.22.23" netmask="255.255.255.255"/>
           </Interface>
           <Interface bridgeport="False" comment="" dyn="False" id="id3DE47B76" label="" mgmt="False" name="eth1" security_level="100" unnum="False" unprotected="False">
-            <IPv4 address="22.22.22.24" comment="" id="id3DE47B77" name="hZ-eth1" netmask="255.255.255.255"/>
+            <IPv4 comment="" id="id3DE47B77" name="hZ-eth1" address="22.22.22.24" netmask="255.255.255.255"/>
           </Interface>
           <Interface bridgeport="False" comment="" dyn="False" id="id3DE47B78" label="" mgmt="False" name="eth2" security_level="100" unnum="False" unprotected="False">
-            <IPv4 address="22.22.22.25" comment="" id="id3DE47B79" name="hZ-eth2" netmask="255.255.255.255"/>
+            <IPv4 comment="" id="id3DE47B79" name="hZ-eth2" address="22.22.22.25" netmask="255.255.255.255"/>
           </Interface>
           <Management address="22.22.22.23">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -435,15 +448,15 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
         <Host comment="broadcast on internal subnet" id="id3B64FFAC" name="local-bcast">
           <Interface bridgeport="False" dyn="False" id="id3B64FFAC-i" name="unknown" security_level="100" unnum="False" unprotected="False">
-            <IPv4 address="192.168.1.255" comment="" id="id3B64FFAC-i-ipv4" name="local-bcast:addess" netmask="255.255.255.255"/>
+            <IPv4 comment="" id="id3B64FFAC-i-ipv4" name="local-bcast:addess" address="192.168.1.255" netmask="255.255.255.255"/>
           </Interface>
           <Management address="192.168.1.255">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -451,15 +464,15 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
         <Host comment="" id="id3CD87A53" name="h192.168.1.11">
           <Interface bridgeport="False" dyn="False" id="id3CD87A53-i" name="interface-1" security_level="0" unnum="False" unprotected="False">
-            <IPv4 address="192.168.1.11" id="id3CD87A53-i-1-addr" name="address" netmask="255.255.255.255"/>
+            <IPv4 id="id3CD87A53-i-1-addr" name="address" address="192.168.1.11" netmask="255.255.255.255"/>
           </Interface>
           <Management address="192.168.1.11">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -467,16 +480,16 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">False</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
         <Host comment="" id="id3CD87A5E" name="h192.168.1.12">
           <Interface bridgeport="False" dyn="False" id="id3CD87A5E-i" name="interface-1" security_level="0" unnum="False" unprotected="False">
-            <IPv4 address="192.168.1.12" id="id3CD87A5E-i-1-addr" name="address" netmask="255.255.255.255"/>
+            <IPv4 id="id3CD87A5E-i-1-addr" name="address" address="192.168.1.12" netmask="255.255.255.255"/>
           </Interface>
           <Management address="192.168.1.12">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -484,16 +497,16 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">False</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
         <Host comment="" id="id3CD87A6D" name="h192.168.1.13">
           <Interface bridgeport="False" dyn="False" id="id3CD87A6D-i" name="interface-1" security_level="0" unnum="False" unprotected="False">
-            <IPv4 address="192.168.1.13" id="id3CD87A6D-i-1-addr" name="address" netmask="255.255.255.255"/>
+            <IPv4 id="id3CD87A6D-i-1-addr" name="address" address="192.168.1.13" netmask="255.255.255.255"/>
           </Interface>
           <Management address="192.168.1.13">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -501,16 +514,16 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">False</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
         <Host comment="" id="id3CD87A7C" name="h192.168.1.14">
           <Interface bridgeport="False" dyn="False" id="id3CD87A7C-i" name="interface-1" security_level="0" unnum="False" unprotected="False">
-            <IPv4 address="192.168.1.14" id="id3CD87A7C-i-1-addr" name="address" netmask="255.255.255.255"/>
+            <IPv4 id="id3CD87A7C-i-1-addr" name="address" address="192.168.1.14" netmask="255.255.255.255"/>
           </Interface>
           <Management address="192.168.1.14">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -518,16 +531,16 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">False</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
         <Host comment="" id="id3CD87A8B" name="h192.168.1.15">
           <Interface bridgeport="False" dyn="False" id="id3CD87A8B-i" name="interface-1" security_level="0" unnum="False" unprotected="False">
-            <IPv4 address="192.168.1.15" id="id3CD87A8B-i-1-addr" name="address" netmask="255.255.255.255"/>
+            <IPv4 id="id3CD87A8B-i-1-addr" name="address" address="192.168.1.15" netmask="255.255.255.255"/>
           </Interface>
           <Management address="192.168.1.15">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -535,16 +548,16 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">False</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
         <Host comment="local link multicast address" id="id3D84EEC8" name="ospf routers (multicast)">
           <Interface bridgeport="False" dyn="False" id="id3D84EECC" name="interface1" security_level="0" unnum="False" unprotected="False">
-            <IPv4 address="224.0.0.5" id="id3D84EECD" name="ospf routers (multicast)" netmask="255.255.255.0"/>
+            <IPv4 id="id3D84EECD" name="ospf routers (multicast)" address="224.0.0.5" netmask="255.255.255.0"/>
           </Interface>
           <Management address="224.0.0.5">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -552,16 +565,16 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
         <Host comment="some host outside our network" id="id3B19C5EB" name="outside-host">
           <Interface bridgeport="False" dyn="False" id="id3B19C5EB-i" name="unknown" security_level="100" unnum="False" unprotected="False">
-            <IPv4 address="200.200.200.200" id="id3B19C5EB-i-ipv4" name="address" netmask="255.255.255.255"/>
+            <IPv4 id="id3B19C5EB-i-ipv4" name="address" address="200.200.200.200" netmask="255.255.255.255"/>
           </Interface>
           <HostOptions>
             <Option name="use_mac_addr_filter">false</Option>
@@ -569,7 +582,7 @@
         </Host>
         <Host comment="" id="host-secondary1-com" name="secondary1.com">
           <Interface bridgeport="False" dyn="False" id="host-secondary1-com-i" name="unknown" security_level="100" unnum="False" unprotected="False">
-            <IPv4 address="211.11.11.11" id="host-secondary1-com-i-ipv4" name="address" netmask="255.255.255.255"/>
+            <IPv4 id="host-secondary1-com-i-ipv4" name="address" address="211.11.11.11" netmask="255.255.255.255"/>
           </Interface>
           <Management address="211.11.11.11">
             <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -582,7 +595,7 @@
         </Host>
         <Host comment="" id="host-secondary2-com" name="secondary2.com">
           <Interface bridgeport="False" dyn="False" id="host-secondary2-com-i" name="unknown" security_level="100" unnum="False" unprotected="False">
-            <IPv4 address="211.22.22.22" id="host-secondary2-com-i-ipv4" name="address" netmask="255.255.255.255"/>
+            <IPv4 id="host-secondary2-com-i-ipv4" name="address" address="211.22.22.22" netmask="255.255.255.255"/>
           </Interface>
           <Management address="211.22.22.22">
             <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -595,7 +608,7 @@
         </Host>
         <Host comment="" id="id3BF23930" name="z-host">
           <Interface bridgeport="False" dyn="False" id="id3BF23931" name="unknown" security_level="100" unnum="False" unprotected="False">
-            <IPv4 address="0.0.0.0" id="id3BF23931-ipv4" name="address" netmask=""/>
+            <IPv4 id="id3BF23931-ipv4" name="address" address="0.0.0.0" netmask="0.0.0.0"/>
             <physAddress address="00:a0:24:53:06:8c" id="id3BF23931-pa" name="unknown-pa"/>
           </Interface>
           <Management address="0.0.0.0">
@@ -609,7 +622,7 @@
         </Host>
         <Host comment="" id="id3D84F6D7" name="zero address">
           <Interface bridgeport="False" dyn="False" id="id3D84F6DB" name="interface1" security_level="0" unnum="False" unprotected="False">
-            <IPv4 address="0.0.0.0" comment="" id="id3D84F6DC" name="zero addr(ip)" netmask="0.0.0.0"/>
+            <IPv4 comment="" id="id3D84F6DC" name="zero addr(ip)" address="0.0.0.0" netmask="0.0.0.0"/>
             <physAddress address="00:00:00:00:00:00" comment="" id="id3E192A36" name="zero addr(MAC)"/>
           </Interface>
           <Management address="0.0.0.0">
@@ -618,19 +631,19 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
         <Host id="id3E9870D1" name="like fw5">
           <Interface bridgeport="False" dyn="False" id="id3E9870D7" name="eth0" security_level="0" unnum="False" unprotected="False">
-            <IPv4 address="192.168.1.1" id="id3E9870D8" name="like fw5:eth0(ip)" netmask="255.255.255.0"/>
+            <IPv4 id="id3E9870D8" name="like fw5:eth0(ip)" address="192.168.1.1" netmask="255.255.255.0"/>
           </Interface>
           <Interface bridgeport="False" dyn="False" id="id3E9870D9" name="eth1" security_level="0" unnum="False" unprotected="False">
-            <IPv4 address="192.168.2.1" id="id3E9870DA" name="like fw5:eth1(ip)" netmask="255.255.255.0"/>
+            <IPv4 id="id3E9870DA" name="like fw5:eth1(ip)" address="192.168.2.1" netmask="255.255.255.0"/>
           </Interface>
           <Management address="0.0.0.0">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -643,7 +656,7 @@
         </Host>
         <Host id="id3E9BC536" name="squid-box">
           <Interface bridgeport="False" dyn="False" id="id3E9BC538" name="interface1" security_level="0" unnum="False" unprotected="False">
-            <IPv4 address="192.168.1.100" id="id3E9BC539" name="squid-box:interface1(ip)" netmask="255.255.255.255"/>
+            <IPv4 id="id3E9BC539" name="squid-box:interface1(ip)" address="192.168.1.100" netmask="255.255.255.255"/>
           </Interface>
           <Management address="0.0.0.0">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -656,7 +669,7 @@
         </Host>
         <Host id="id3EE4CC6E" name="like fw18(eth1)">
           <Interface bridgeport="False" dyn="False" id="id3EE4CC70" name="interface1" security_level="0" unnum="False" unprotected="False">
-            <IPv4 address="66.66.66.130" id="id3EE4CC71" name="like fw18(eth1):interface1(ip)" netmask="255.255.255.255"/>
+            <IPv4 id="id3EE4CC71" name="like fw18(eth1):interface1(ip)" address="66.66.66.130" netmask="255.255.255.255"/>
           </Interface>
           <Management address="0.0.0.0">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -669,7 +682,7 @@
         </Host>
         <Host comment="this host has the same IP address as firewall 'firewall', plus it has MAC address.&#10;Testing for a combination of &quot;--mac --source-mac&quot; in the OUTPUT chain.&#10;" id="id3F14DFB8" name="fw-with-mac-1">
           <Interface bridgeport="False" comment="" dyn="False" id="id3F14DFB9" label="" mgmt="False" name="host-with-mac-1:1" security_level="100" unnum="False" unprotected="False">
-            <IPv4 address="192.168.1.1" comment="" id="id3F14DFBA" name="host-with-mac-1/addr" netmask="255.255.255.0"/>
+            <IPv4 comment="" id="id3F14DFBA" name="host-with-mac-1/addr" address="192.168.1.1" netmask="255.255.255.0"/>
             <physAddress address="00:10:4b:de:e9:6f" id="id3F14DFBB" name="host-with-mac-1:1-pa"/>
           </Interface>
           <Management address="192.168.1.10">
@@ -678,15 +691,15 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr_filter">True</Option>
           </HostOptions>
         </Host>
         <Host comment="this host has the same IP address as firewall 'firewall', plus it has MAC address.&#10;Testing for a combination of &quot;--mac --source-mac&quot; in the OUTPUT chain.&#10;" id="id3F14E244" name="fw-with-mac-2">
           <Interface bridgeport="False" comment="" dyn="False" id="id3F14E245" label="" mgmt="False" name="host-with-mac-1:1" security_level="100" unnum="False" unprotected="False">
-            <IPv4 address="192.168.1.1" comment="" id="id3F14E246" name="host-with-mac-1/addr" netmask="255.255.255.0"/>
+            <IPv4 comment="" id="id3F14E246" name="host-with-mac-1/addr" address="192.168.1.1" netmask="255.255.255.0"/>
             <physAddress address="00:10:4b:de:e9:6f" id="id3F14E247" name="host-with-mac-1:1-pa"/>
           </Interface>
           <Management address="192.168.1.1">
@@ -695,15 +708,15 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr_filter">True</Option>
           </HostOptions>
         </Host>
         <Host comment="usef in fw7&#10;" id="id40236C4D" name="dhcpserver">
           <Interface bridgeport="False" dyn="False" id="id40236C4F" name="interface1" security_level="0" unnum="False" unprotected="False">
-            <IPv4 address="192.168.2.10" id="id40236C50" name="dhcpserver:interface1(ip)" netmask="255.255.255.255"/>
+            <IPv4 id="id40236C50" name="dhcpserver:interface1(ip)" address="192.168.2.10" netmask="255.255.255.255"/>
           </Interface>
           <Management address="192.168.2.10">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -711,16 +724,16 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr">false</Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
         <Host id="id40236C9A" name="unknown">
           <Interface bridgeport="False" dyn="False" id="id40236C9C" name="interface1" security_level="0" unnum="False" unprotected="False">
-            <IPv4 address="0.0.0.0" id="id40236C9D" name="unknown:interface1(ip)" netmask="255.255.255.255"/>
+            <IPv4 id="id40236C9D" name="unknown:interface1(ip)" address="0.0.0.0" netmask="255.255.255.255"/>
           </Interface>
           <Management address="0.0.0.0">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -733,7 +746,7 @@
         </Host>
         <Host id="id40F195D2" name="hostC">
           <Interface bridgeport="False" dyn="False" id="id40F195D4" label="" name="eth0" security_level="0" unnum="False" unprotected="False">
-            <IPv4 address="192.168.1.50" id="id40F195D6" name="hostC:eth0:ip" netmask="255.255.255.0"/>
+            <IPv4 id="id40F195D6" name="hostC:eth0:ip" address="192.168.1.50" netmask="255.255.255.0"/>
           </Interface>
           <Management address="0.0.0.0">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -744,7 +757,7 @@
         </Host>
         <Host comment="" id="id43913DCB25682" name="hostAt">
           <Interface bridgeport="False" dyn="False" id="id43913DCD25682" label="" name="hostA_eth0" security_level="100" unnum="False" unprotected="False">
-            <IPv4 address="192.168.1.10" id="id43913DCE25682" name="hostAt:hostA_eth0:ip" netmask="255.255.255.255"/>
+            <IPv4 id="id43913DCE25682" name="hostAt:hostA_eth0:ip" address="192.168.1.10" netmask="255.255.255.255"/>
           </Interface>
           <Management address="192.168.1.10">
             <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
@@ -752,15 +765,15 @@
             <PolicyInstallScript arguments="" command="" enabled="False"/>
           </Management>
           <HostOptions>
-            <Option name="snmp_contact"/>
-            <Option name="snmp_description"/>
-            <Option name="snmp_location"/>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
             <Option name="use_mac_addr_filter">False</Option>
           </HostOptions>
         </Host>
         <Host comment="This object represents a PC with a single network interface" id="id445F59D831658" name="exthost223">
           <Interface bridgeport="False" dyn="False" id="id445F59DA31658" label="" name="eth0" security_level="0" unnum="False" unprotected="False">
-            <IPv4 address="223.223.223.223" comment="" id="id445F59DB31658" name="exthost223:eth0:ip" netmask="255.255.255.0"/>
+            <IPv4 comment="" id="id445F59DB31658" name="exthost223:eth0:ip" address="223.223.223.223" netmask="255.255.255.0"/>
           </Interface>
           <Management address="0.0.0.0">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -773,13 +786,13 @@
         </Host>
         <Host comment="" id="id47CD183A7550" name="host with multiple interfaces">
           <Interface bridgeport="False" dyn="False" id="id47CD183C7550" name="eth0" security_level="0" unnum="False" unprotected="False">
-            <IPv4 address="192.168.1.1" id="id47CD183D7550" name="host with multiple interfaces:eth0:ip" netmask="255.255.255.0"/>
+            <IPv4 id="id47CD183D7550" name="host with multiple interfaces:eth0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
           </Interface>
           <Interface bridgeport="False" dyn="False" id="id47CD183E7550" name="eth1" security_level="0" unnum="False" unprotected="False">
-            <IPv4 address="192.168.2.1" id="id47CD183F7550" name="host with multiple interfaces:eth1:ip" netmask="255.255.255.0"/>
+            <IPv4 id="id47CD183F7550" name="host with multiple interfaces:eth1:ip" address="192.168.2.1" netmask="255.255.255.0"/>
           </Interface>
           <Interface bridgeport="False" comment="" dyn="False" id="id47CD49057550" label="" name="eth2" security_level="0" unnum="False" unprotected="False">
-            <IPv4 address="77.77.77.77" comment="" id="id47CD49067550" name="host with multiple interfaces:eth2:ip" netmask="255.255.255.0"/>
+            <IPv4 comment="" id="id47CD49067550" name="host with multiple interfaces:eth2:ip" address="77.77.77.77" netmask="255.255.255.0"/>
           </Interface>
           <Management address="0.0.0.0">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -793,7 +806,7 @@
         </Host>
         <Host comment="" id="id48356E0A14854" name="like fw2(eth3)-1">
           <Interface bridgeport="False" dyn="False" id="id48356E0C14854" name="interface1" security_level="0" unnum="False" unprotected="False">
-            <IPv4 address="22.22.25.50" comment="" id="id48356E0D14854" name="like fw2(eth3)-1:interface1:ip" netmask="255.255.255.255"/>
+            <IPv4 comment="" id="id48356E0D14854" name="like fw2(eth3)-1:interface1:ip" address="22.22.25.50" netmask="255.255.255.255"/>
           </Interface>
           <Management address="0.0.0.0">
             <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
@@ -817,6 +830,7 @@
         <Network comment="" id="id3EFBCCBA" name="ppp-net" address="10.1.1.0" netmask="255.255.255.0"/>
         <Network comment="" id="id43913DEA25682" name="Internal_net_t" address="192.168.1.0" netmask="255.255.255.0"/>
         <Network comment="" id="id4733FFE419714" name="n-192.168.2.0" address="192.168.2.0" netmask="255.255.255.0"/>
+        <NetworkIPv6 comment="" id="id4834B9206131" name="net-fe80" address="fe80::" netmask="64"/>
       </ObjectGroup>
       <ObjectGroup id="stdid15_1" name="Address Ranges">
         <AddressRange comment="" id="id3CD8769F" name="test_range_1" start_address="192.168.1.11" end_address="192.168.1.15"/>
@@ -830,11 +844,12 @@
     </ObjectGroup>
     <ServiceGroup id="stdid05_1" name="Services">
       <ServiceGroup id="stdid05_1_userservices" name="User"/>
-        <ServiceGroup id="stdid05_1_og_tag_1" name="TagServices">
+      <ServiceGroup id="stdid05_1_og_tag_1" name="TagServices">
         <TagService comment="" id="id43EC877332486" name="tag16" tagcode="16"/>
         <TagService comment="" id="id449328D824380" name="Tag1" tagcode="1"/>
         <TagService comment="" id="id449328D924380" name="Tag2" tagcode="2"/>
-      </ServiceGroup><ServiceGroup id="stdid10_1" name="Groups">
+      </ServiceGroup>
+      <ServiceGroup id="stdid10_1" name="Groups">
         <ServiceGroup id="id3B457567" name="svcgroup1">
           <ServiceRef ref="id3B457561"/>
           <ServiceRef ref="ip-IPSEC"/>
@@ -924,14 +939,17 @@
           <ServiceRef ref="id3B4FEDA3"/>
           <ServiceRef ref="id3B4FED69"/>
         </ServiceGroup>
-      </ServiceGroup><ServiceGroup id="stdid07_1" name="ICMP">
+      </ServiceGroup>
+      <ServiceGroup id="stdid07_1" name="ICMP">
         <ICMPService code="-1" comment="" id="id3C1A5D46" name="any ICMP" type="-1"/>
-      </ServiceGroup><ServiceGroup id="stdid06_1" name="IP">
+      </ServiceGroup>
+      <ServiceGroup id="stdid06_1" name="IP">
         <IPService comment="" fragm="False" id="id3B457561" lsrr="False" name="ICMP" protocol_num="1" rr="False" short_fragm="False" ssrr="False" ts="False"/>
         <IPService comment="" fragm="False" id="id3B6659A5" lsrr="False" name="TS" protocol_num="0" rr="False" short_fragm="False" ssrr="False" ts="True"/>
         <IPService comment="" fragm="False" id="id3F3E9EFC" lsrr="False" name="EIGRP" protocol_num="88" rr="False" short_fragm="False" ssrr="False" ts="False"/>
         <IPService comment="" fragm="False" id="id419D6869" lsrr="False" name="any protocol" protocol_num="0" rr="False" short_fragm="False" ssrr="False" ts="False"/>
-      </ServiceGroup><ServiceGroup id="stdid09_1" name="TCP">
+      </ServiceGroup>
+      <ServiceGroup id="stdid09_1" name="TCP">
         <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="70" dst_range_start="70" fin_flag="False" fin_flag_mask="False" id="id3C1A66EF" name="gopher" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
         <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="6667" dst_range_start="6667" fin_flag="False" fin_flag_mask="False" id="tcp-IRC" name="irc" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
         <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="3128" dst_range_start="3128" fin_flag="False" fin_flag_mask="False" id="id3B5009F7" name="squid" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
@@ -947,55 +965,57 @@
         <TCPService ack_flag="False" ack_flag_mask="True" comment="" dst_range_end="0" dst_range_start="0" fin_flag="False" fin_flag_mask="True" id="id3E3747AF" name="TCP no flags" psh_flag="False" psh_flag_mask="True" rst_flag="False" rst_flag_mask="True" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="True" urg_flag="False" urg_flag_mask="True"/>
         <TCPService ack_flag="False" ack_flag_mask="True" comment="TCP packet with dest. port 5190 (AIM) and SYN flag set&#10;This is the opening of the new AIM session" dst_range_end="5190" dst_range_start="5190" fin_flag="False" fin_flag_mask="True" id="id40038E79" name="new AIM connection" psh_flag="False" psh_flag_mask="True" rst_flag="False" rst_flag_mask="True" src_range_end="0" src_range_start="0" syn_flag="True" syn_flag_mask="True" urg_flag="False" urg_flag_mask="True"/>
         <TCPService ack_flag="True" ack_flag_mask="True" comment="" dst_range_end="0" dst_range_start="0" fin_flag="False" fin_flag_mask="True" id="id459E36F110170" name="ack" psh_flag="False" psh_flag_mask="True" rst_flag="False" rst_flag_mask="True" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="True" urg_flag="False" urg_flag_mask="True"/>
-      </ServiceGroup><ServiceGroup id="stdid08_1" name="UDP">
+      </ServiceGroup>
+      <ServiceGroup id="stdid08_1" name="UDP">
         <UDPService comment="" dst_range_end="0" dst_range_start="0" id="id3ED59BF0" name="udp-src-6767" src_range_end="6767" src_range_start="6767"/>
         <UDPService comment="" dst_range_end="0" dst_range_start="0" id="id3ED59BF1" name="udp-src-67" src_range_end="67" src_range_start="67"/>
-      </ServiceGroup><ServiceGroup id="stdid13_1" name="Custom">
+      </ServiceGroup>
+      <ServiceGroup id="stdid13_1" name="Custom">
         <CustomService comment="Talk support" id="id3B64FE22" name="talk">
-          <CustomServiceCommand platform="Undefined"/>
-          <CustomServiceCommand platform="fwsm"/>
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfilter"/>
-          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="fwsm"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m ip_conntrack_talk -m ip_nat_talk</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
         <CustomService comment="" id="id3D34B329" name="test-custom-1">
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-p tcp -m state --state ESTABLISHED --tcp-flags SYN,ACK,RST,URG ACK</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
         <CustomService comment="" id="id3D34B32A" name="test-custom-2">
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-p tcp -m state --state ESTABLISHED --tcp-flags SYN,FIN,RST,URG,PSH RST</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
         <CustomService comment="" id="id3FADE3CC" name="string">
           <CustomServiceCommand platform="ipf">-m string --string test_pattern</CustomServiceCommand>
-          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-m string --string test_pattern</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
         <CustomService comment="" id="id4003B1AC" name="old AIM session">
-          <CustomServiceCommand platform="ipf"/>
-          <CustomServiceCommand platform="ipfw"/>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
           <CustomServiceCommand platform="iptables">-p tcp ! --syn -dport 5190 -m state --state NEW</CustomServiceCommand>
-          <CustomServiceCommand platform="pf"/>
-          <CustomServiceCommand platform="pix"/>
-          <CustomServiceCommand platform="unknown"/>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
         </CustomService>
       </ServiceGroup>
-      </ServiceGroup>
+    </ServiceGroup>
     <ObjectGroup id="stdid12_1" name="Firewalls">
       <Firewall comment="this is simple firewall with two interfaces. Test regular policy rules, including IP_fragments rule" host_OS="linux24" id="fw-firewall2" inactive="False" lastCompiled="1210000429" lastInstalled="1142003872" lastModified="1210000442" name="firewall" platform="iptables" ro="False" version="">
         <NAT id="nat-firewall2" name="NAT">
@@ -1019,7 +1039,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3CEBFE6E" position="1">
+          </NATRule>
+          <NATRule disabled="False" id="id3CEBFE6E" position="1">
             <OSrc neg="False">
               <ObjectRef ref="id3CEBFDFC"/>
             </OSrc>
@@ -1039,7 +1060,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3CEBFFA8" position="2">
+          </NATRule>
+          <NATRule disabled="False" id="id3CEBFFA8" position="2">
             <OSrc neg="False">
               <ObjectRef ref="id3CEBFF26"/>
             </OSrc>
@@ -1059,7 +1081,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="True" id="id3CECB632" position="3">
+          </NATRule>
+          <NATRule disabled="True" id="id3CECB632" position="3">
             <OSrc neg="False">
               <ObjectRef ref="id3CEBFDFC"/>
             </OSrc>
@@ -1079,7 +1102,8 @@
               <ServiceRef ref="id3B5009F7"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3CECB708" position="4">
+          </NATRule>
+          <NATRule disabled="False" id="id3CECB708" position="4">
             <OSrc neg="False">
               <ObjectRef ref="id3CEBFDFC"/>
             </OSrc>
@@ -1099,7 +1123,8 @@
               <ServiceRef ref="id3B5009F7"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3D20E9DB" position="5">
+          </NATRule>
+          <NATRule disabled="False" id="id3D20E9DB" position="5">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -1120,7 +1145,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="nat-firewall2-1" position="6">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="nat-firewall2-1" position="6">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -1140,7 +1166,8 @@
               <ServiceRef ref="tcp-SMTP"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3F3BCA90" position="7">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3F3BCA90" position="7">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -1160,7 +1187,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3F3BCAD1" position="8">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3F3BCAD1" position="8">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -1180,7 +1208,8 @@
               <ServiceRef ref="icmp-ping_request"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3CE71A93" position="9">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3CE71A93" position="9">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -1200,7 +1229,8 @@
               <ServiceRef ref="id3CE719F5"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3CE71B09" position="10">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3CE71B09" position="10">
             <OSrc neg="False">
               <ObjectRef ref="host-hostA"/>
             </OSrc>
@@ -1220,7 +1250,8 @@
               <ServiceRef ref="id3CE719F5"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3E0AAAF2" position="11">
+          </NATRule>
+          <NATRule disabled="False" id="id3E0AAAF2" position="11">
             <OSrc neg="False">
               <ObjectRef ref="id3BF1B3E2"/>
             </OSrc>
@@ -1240,7 +1271,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3E0AADCD" position="12">
+          </NATRule>
+          <NATRule disabled="False" id="id3E0AADCD" position="12">
             <OSrc neg="False">
               <ObjectRef ref="id3BF1B3E8-pa"/>
             </OSrc>
@@ -1260,7 +1292,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3E69B092" position="13">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3E69B092" position="13">
             <OSrc neg="False">
               <ObjectRef ref="id3E0F3FC8"/>
             </OSrc>
@@ -1280,7 +1313,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id445F52DE31658" position="14">
+          </NATRule>
+          <NATRule disabled="False" id="id445F52DE31658" position="14">
             <OSrc neg="False">
               <ObjectRef ref="id3DB0B356"/>
             </OSrc>
@@ -1300,7 +1334,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3CE7198B" position="15">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3CE7198B" position="15">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -1320,7 +1355,8 @@
               <ServiceRef ref="id3CE71594"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3CE719A3" position="16">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3CE719A3" position="16">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -1340,7 +1376,8 @@
               <ServiceRef ref="id3CE717A0"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3CE71AF1" position="17">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3CE71AF1" position="17">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -1360,7 +1397,8 @@
               <ServiceRef ref="id3CE719F3"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3CE71B86" position="18">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3CE71B86" position="18">
             <OSrc neg="False">
               <ObjectRef ref="host-hostA"/>
             </OSrc>
@@ -1380,7 +1418,8 @@
               <ServiceRef ref="id3CE719F3"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3EA8DC47" position="19">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3EA8DC47" position="19">
             <OSrc neg="False">
               <ObjectRef ref="host-hostA"/>
             </OSrc>
@@ -1400,7 +1439,8 @@
               <ServiceRef ref="tcp-HTTP"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3EA8DB2C" position="20">
+          </NATRule>
+          <NATRule disabled="False" id="id3EA8DB2C" position="20">
             <OSrc neg="False">
               <ObjectRef ref="fw-firewall2"/>
             </OSrc>
@@ -1420,7 +1460,8 @@
               <ServiceRef ref="tcp-HTTP"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="should use multiport&#10;and account for&#10;no more than 15 ports&#10;per rule" disabled="False" id="id3EF41DD4" position="21">
+          </NATRule>
+          <NATRule comment="should use multiport&#10;and account for&#10;no more than 15 ports&#10;per rule" disabled="False" id="id3EF41DD4" position="21">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -1440,7 +1481,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="should use multiport&#10;and account for&#10;no more than 15 ports&#10;per rule" disabled="False" id="id3EF4288E" position="22">
+          </NATRule>
+          <NATRule comment="should use multiport&#10;and account for&#10;no more than 15 ports&#10;per rule" disabled="False" id="id3EF4288E" position="22">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -1460,18 +1502,23 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule></NAT>
-          <Policy id="pol-firewall2" name="Policy">
+          </NATRule>
+        </NAT>
+        <Policy id="pol-firewall2" name="Policy">
           <PolicyRule action="Deny" comment="Automatically generated rule blocking short fragments" direction="Inbound" disabled="False" id="pol-firewall2-0" log="True" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="ip-IP_Fragments"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="if-FW-firewall2-eth1"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -1482,13 +1529,17 @@
           <PolicyRule action="Deny" direction="Inbound" disabled="False" id="id3B09D29D" log="True" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="fw-firewall2"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="ip-IP_Fragments"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="if-FW-firewall2-eth1"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -1500,13 +1551,17 @@
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="fw-firewall2"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="if-FW-firewall2-eth1"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -1517,13 +1572,17 @@
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id3B92DFC5" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="fw-firewall2"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="udp-DNS"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="if-FW-firewall2-eth0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -1533,13 +1592,17 @@
           <PolicyRule action="Deny" comment="code should go into INPUT chain with &#10;address in destination for comparison" direction="Inbound" disabled="False" id="id3C4E4C38" log="True" position="4">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B64FFAC"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="udp-DNS"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="if-FW-firewall2-eth0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -1550,13 +1613,17 @@
           <PolicyRule action="Accept" direction="Inbound" disabled="False" id="id3E021435" log="False" position="5">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-HTTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="if-FW-firewall2-eth0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -1566,14 +1633,18 @@
           <PolicyRule action="Deny" comment="reject using connlimit" direction="Inbound" disabled="False" id="id433BF95F26912" log="False" position="6">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="fw-firewall2"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="if-FW-firewall2-eth0"/>
               <ObjectRef ref="if-FW-firewall2-eth1"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -1582,10 +1653,10 @@
               <Option name="connlimit_value">2</Option>
               <Option name="firewall_is_part_of_any_and_networks">False</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
@@ -1593,14 +1664,18 @@
           <PolicyRule action="Deny" comment="reject using connlimit" direction="Inbound" disabled="False" id="id446828293610" log="False" position="7">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="fw-firewall2"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="if-FW-firewall2-eth0"/>
               <ObjectRef ref="if-FW-firewall2-eth1"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -1614,10 +1689,10 @@
               <Option name="hashlimit_suffix">/second</Option>
               <Option name="hashlimit_value">2</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
@@ -1625,14 +1700,18 @@
           <PolicyRule action="Accept" comment="" direction="Inbound" disabled="False" id="id44670E149065" log="False" position="8">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="fw-firewall2"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="if-FW-firewall2-eth0"/>
               <ObjectRef ref="if-FW-firewall2-eth1"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -1641,10 +1720,10 @@
               <Option name="connlimit_value">0</Option>
               <Option name="firewall_is_part_of_any_and_networks">False</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">False</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
@@ -1652,13 +1731,17 @@
           <PolicyRule action="Accept" comment="OUTPUT" direction="Outbound" disabled="False" id="id469F1D0830391" log="False" position="9">
             <Src neg="False">
               <ObjectRef ref="fw-firewall2"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id44F7082928576"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -1672,15 +1755,15 @@
               <Option name="hashlimit_gcinterval">0</Option>
               <Option name="hashlimit_max">0</Option>
               <Option name="hashlimit_mode">dstip</Option>
-              <Option name="hashlimit_name"/>
+              <Option name="hashlimit_name"></Option>
               <Option name="hashlimit_size">0</Option>
-              <Option name="hashlimit_suffix"/>
+              <Option name="hashlimit_suffix"></Option>
               <Option name="hashlimit_value">0</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
@@ -1688,13 +1771,17 @@
           <PolicyRule action="Accept" comment="INTPUT" direction="Inbound" disabled="False" id="id469F1CF730391" log="False" position="10">
             <Src neg="False">
               <ObjectRef ref="id44F7082928576"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="fw-firewall2"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -1708,15 +1795,15 @@
               <Option name="hashlimit_gcinterval">0</Option>
               <Option name="hashlimit_max">0</Option>
               <Option name="hashlimit_mode">dstip</Option>
-              <Option name="hashlimit_name"/>
+              <Option name="hashlimit_name"></Option>
               <Option name="hashlimit_size">0</Option>
-              <Option name="hashlimit_suffix"/>
+              <Option name="hashlimit_suffix"></Option>
               <Option name="hashlimit_value">0</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
@@ -1724,13 +1811,17 @@
           <PolicyRule action="Accept" comment="OUTPUT + FORWARD" direction="Outbound" disabled="False" id="id469F1CE630391" log="False" position="11">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id44F7082928576"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -1744,15 +1835,15 @@
               <Option name="hashlimit_gcinterval">0</Option>
               <Option name="hashlimit_max">0</Option>
               <Option name="hashlimit_mode">dstip</Option>
-              <Option name="hashlimit_name"/>
+              <Option name="hashlimit_name"></Option>
               <Option name="hashlimit_size">0</Option>
-              <Option name="hashlimit_suffix"/>
+              <Option name="hashlimit_suffix"></Option>
               <Option name="hashlimit_value">0</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
@@ -1760,13 +1851,17 @@
           <PolicyRule action="Accept" comment="INPUT + FORWARD" direction="Inbound" disabled="False" id="id469F1CD530391" log="False" position="12">
             <Src neg="False">
               <ObjectRef ref="id44F7082928576"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -1780,15 +1875,15 @@
               <Option name="hashlimit_gcinterval">0</Option>
               <Option name="hashlimit_max">0</Option>
               <Option name="hashlimit_mode">dstip</Option>
-              <Option name="hashlimit_name"/>
+              <Option name="hashlimit_name"></Option>
               <Option name="hashlimit_size">0</Option>
-              <Option name="hashlimit_suffix"/>
+              <Option name="hashlimit_suffix"></Option>
               <Option name="hashlimit_value">0</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
@@ -1796,13 +1891,17 @@
           <PolicyRule action="Accept" comment="OUTPUT + FORWARD" direction="Both" disabled="False" id="id469F1CC430391" log="False" position="13">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id44F7082928576"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -1816,15 +1915,15 @@
               <Option name="hashlimit_gcinterval">0</Option>
               <Option name="hashlimit_max">0</Option>
               <Option name="hashlimit_mode">dstip</Option>
-              <Option name="hashlimit_name"/>
+              <Option name="hashlimit_name"></Option>
               <Option name="hashlimit_size">0</Option>
-              <Option name="hashlimit_suffix"/>
+              <Option name="hashlimit_suffix"></Option>
               <Option name="hashlimit_value">0</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
@@ -1832,13 +1931,17 @@
           <PolicyRule action="Accept" comment="INPUT + FORWARD" direction="Both" disabled="False" id="id469F1CB330391" log="False" position="14">
             <Src neg="False">
               <ObjectRef ref="id44F7082928576"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -1852,15 +1955,15 @@
               <Option name="hashlimit_gcinterval">0</Option>
               <Option name="hashlimit_max">0</Option>
               <Option name="hashlimit_mode">dstip</Option>
-              <Option name="hashlimit_name"/>
+              <Option name="hashlimit_name"></Option>
               <Option name="hashlimit_size">0</Option>
-              <Option name="hashlimit_suffix"/>
+              <Option name="hashlimit_suffix"></Option>
               <Option name="hashlimit_value">0</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
@@ -1868,38 +1971,46 @@
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id3B58E39D" log="True" position="15">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-TCP-SYN"/>
               <ServiceRef ref="id3B58E3F1"/>
               <ServiceRef ref="id3C1A5D46"/>
               <ServiceRef ref="id3E3747AF"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"/>
-              <Option name="log_prefix"/>
+              <Option name="log_limit_suffix"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id3B6659FC" log="True" position="16">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="ip-RR"/>
               <ServiceRef ref="ip-SRR"/>
               <ServiceRef ref="id3B6659A5"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -1909,13 +2020,17 @@
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id3D34B4D8" log="True" position="17">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3D34B32B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -1926,14 +2041,18 @@
             <Src neg="False">
               <ObjectRef ref="fw-firewall2"/>
               <ObjectRef ref="id3D0C1E6E"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3D0C1E6E"/>
               <ObjectRef ref="fw-firewall2"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -1944,16 +2063,20 @@
               <ObjectRef ref="id3D0C1E77"/>
               <ObjectRef ref="id3D0C1E7A"/>
               <ObjectRef ref="id3D0C1E7D"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="fw-firewall2"/>
               <ObjectRef ref="id3D0C1E77"/>
               <ObjectRef ref="id3D0C1E7A"/>
               <ObjectRef ref="id3D0C1E7D"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -1961,32 +2084,40 @@
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id3BF1B45E" log="False" position="20">
             <Src neg="False">
               <ObjectRef ref="id3BF1B3E1"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="host-hostA"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
+              <Option name="log_prefix"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id3E0AA611" log="False" position="21">
             <Src neg="False">
               <ObjectRef ref="id3BF1B3E2"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="fw-firewall2"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -1994,32 +2125,40 @@
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id3BF1B44E" log="False" position="22">
             <Src neg="False">
               <ObjectRef ref="id3BF1B3E7"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="host-hostA"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
+              <Option name="log_prefix"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id3E0AA504" log="False" position="23">
             <Src neg="False">
               <ObjectRef ref="id3BF1B3E8-pa"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="fw-firewall2"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -2027,13 +2166,17 @@
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id3E0AA635" log="False" position="24">
             <Src neg="False">
               <ObjectRef ref="id3BF1B3E8-pa"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B19C5EB"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -2041,13 +2184,17 @@
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id3E0F40D5" log="False" position="25">
             <Src neg="False">
               <ObjectRef ref="id3E0F3FC8"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="fw-firewall2"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -2055,13 +2202,17 @@
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id3E0F452C" log="False" position="26">
             <Src neg="False">
               <ObjectRef ref="id3E0F3FCB"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="fw-firewall2"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -2069,13 +2220,17 @@
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id3DB0B422" log="False" position="27">
             <Src neg="False">
               <ObjectRef ref="id3DB0B356"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="host-hostA"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -2084,13 +2239,17 @@
             <Src neg="False">
               <ObjectRef ref="id3DB0B356"/>
               <ObjectRef ref="host-hostB"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="host-hostA"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -2098,13 +2257,17 @@
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id3DE474B7" log="False" position="29">
             <Src neg="False">
               <ObjectRef ref="id3DB0B356"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="host-hostA"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CE717A0"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -2112,32 +2275,40 @@
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="pol-firewall2-2" log="False" position="30">
             <Src neg="False">
               <ObjectRef ref="id3DB0B356"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="host-hostA"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3C1A66C9"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
+              <Option name="log_prefix"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id445FAA6D31658" log="False" position="31">
             <Src neg="False">
               <ObjectRef ref="id3DB0B356"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-HTTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -2145,13 +2316,17 @@
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id3F14E0F4" log="False" position="32">
             <Src neg="False">
               <ObjectRef ref="id3F14DFB8"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="host-hostA"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -2160,37 +2335,45 @@
             <Src neg="False">
               <ObjectRef ref="host-secondary1-com"/>
               <ObjectRef ref="host-secondary2-com"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="host-hostA"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="int-afterhours"/>
               <IntervalRef ref="id3C63479C"/>
               <IntervalRef ref="id3C63479E"/>
               <IntervalRef ref="id3D6864D0"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
+              <Option name="log_prefix"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id3FB8455E" log="False" position="34">
             <Src neg="False">
               <ObjectRef ref="host-secondary1-com"/>
               <ObjectRef ref="host-secondary2-com"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3C1A66C9"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -2198,13 +2381,17 @@
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id3CE71635" log="False" position="35">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="host-hostA"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CE71594"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -2212,16 +2399,20 @@
           <PolicyRule action="Accept" comment="Rule #20 test: from Rock&#10;" direction="Both" disabled="False" id="id3CE716F8" log="False" position="36">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="host-hostA"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CE71594"/>
               <ServiceRef ref="tcp-DNS_zone_transf"/>
               <ServiceRef ref="id3CE717A0"/>
               <ServiceRef ref="id3B5009F7"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -2229,73 +2420,89 @@
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="pol-firewall2-4" log="False" position="37">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sg-Useful_ICMP"/>
               <ServiceRef ref="id3B64FE22"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
+              <Option name="log_prefix"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id3CD8770E" log="False" position="38">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3CD8769F"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3B64FE22"/>
               <ServiceRef ref="id3CD878C8"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
+              <Option name="log_prefix"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id3CD87B1E" log="False" position="39">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3CD87A9A"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3B64FE22"/>
               <ServiceRef ref="id3CD878C8"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
+              <Option name="log_prefix"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Accept" comment="group &quot;special combined srv&quot;&#10;has couple of UDP services,&#10;plus &quot;ALL UDP&quot; service, which has&#10;empty ports specs. This is special&#10;case for multiport." direction="Both" disabled="False" id="id3E1FD93A" log="False" position="40">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="fw-firewall2"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3E1FDDBB"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -2303,13 +2510,17 @@
           <PolicyRule action="Accept" comment="another test case for multiport: this rule&#10;has 16 TCP services and should be split onto&#10;two rules. If both rules use &quot;-m multiport&quot;, then &#10;rule with a single service should use &quot;--dports&quot;.&#10;It may be acceptable to not use multiport&#10;in the rule with a single service at all." direction="Both" disabled="False" id="id41D0F052" log="True" position="41">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3CD8769F"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id41D0F023"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -2317,13 +2528,17 @@
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id3B58E180" log="True" position="42">
             <Src neg="False">
               <ObjectRef ref="fw-firewall2"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="fw-firewall2"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -2331,13 +2546,17 @@
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id3D41A4F4" log="False" position="43">
             <Src neg="False">
               <ObjectRef ref="fw-firewall2"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3D41A435"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="udp-SNMP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -2346,32 +2565,40 @@
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="fw-firewall2"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
+              <Option name="log_prefix"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Accept" comment="similar to a standard 'masquerading'&#10;rule, but not so permissive as it does &#10;not allow access to the firewall" direction="Both" disabled="False" id="id3CE894DA" log="False" position="45">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="fw-firewall2"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -2379,14 +2606,18 @@
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id40F1CFA3" log="False" position="46">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="fw-firewall2"/>
               <ObjectRef ref="id3B665643"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -2394,13 +2625,17 @@
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id413D6500" log="False" position="47">
             <Src neg="False">
               <ObjectRef ref="id3BBC0EFC"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3BBC0EFC"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3D4DE626"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -2408,87 +2643,89 @@
           <PolicyRule action="Deny" comment="Automatically generated 'catch all' rule" direction="Both" disabled="False" id="pol-firewall2-7" log="True" position="48">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_limit_suffix"/>
-              <Option name="log_prefix"/>
+              <Option name="log_limit_suffix"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="fw-firewall2-routing" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="" dyn="False" id="if-FW-firewall2-eth1" label="" mgmt="False" name="eth1" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="222.222.222.222" id="if-FW-firewall2-eth1-ipv4" name="address" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="if-FW-firewall2-eth0" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.1" id="if-FW-firewall2-eth0-ipv4" name="address" netmask="255.255.255.0"/>
+        </Policy>
+        <Routing id="fw-firewall2-routing" name="Routing"/>
+        <Interface bridgeport="False" comment="" dyn="False" id="if-FW-firewall2-eth1" label="" mgmt="False" name="eth1" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="if-FW-firewall2-eth1-ipv4" name="address" address="222.222.222.222" netmask="255.255.255.0"/>
         </Interface>
-          <Management address="192.168.1.1">
+        <Interface bridgeport="False" comment="" dyn="False" id="if-FW-firewall2-eth0" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="if-FW-firewall2-eth0-ipv4" name="address" address="192.168.1.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Management address="192.168.1.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
           <FWBDManagement enabled="False" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="/usr/bin/fwb_install" enabled="True"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">False</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="cmdline">-v</Option>
-          <Option name="compiler"/>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">True</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="epilog_script"/>
-          <Option name="firewall_dir"/>
+          <Option name="epilog_script"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/second</Option>
           <Option name="limit_value">5</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
           <Option name="linux24_ip_forward">1</Option>
-          <Option name="linux24_log_martians"/>
+          <Option name="linux24_log_martians"></Option>
           <Option name="linux24_path_ip">/usr/local/sbin/ip</Option>
           <Option name="linux24_path_iptables">/usr/local/sbin/iptables</Option>
           <Option name="linux24_path_logger">/bin/logger</Option>
-          <Option name="linux24_path_lsmod"/>
+          <Option name="linux24_path_lsmod"></Option>
           <Option name="linux24_path_modprobe">/usr/local/sbin/modprobe</Option>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">True</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -2506,15 +2743,15 @@
           <Option name="mgmt_ssh">True</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="platform">iptables</Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"/>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
-          <Option name="sshArgs"/>
+          <Option name="prolog_script"></Option>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -2523,7 +2760,7 @@
           <Option name="use_numeric_log_levels">True</Option>
           <Option name="verify_interfaces">True</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="this object is used to test all kinds of negation in policy and NAT rules" host_OS="linux24" id="id3AF5AA0A" inactive="False" lastCompiled="1210000488" lastInstalled="1142003872" lastModified="1210000492" name="firewall1" platform="iptables" ro="False" version="">
         <NAT id="id3AF5AA0D" name="NAT">
           <NATRule disabled="False" id="id3C98491C" position="0">
@@ -2546,7 +2783,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3AFADC09" position="1">
+          </NATRule>
+          <NATRule disabled="False" id="id3AFADC09" position="1">
             <OSrc neg="False">
               <ObjectRef ref="host-hostA"/>
             </OSrc>
@@ -2566,7 +2804,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3CD23959" position="2">
+          </NATRule>
+          <NATRule disabled="False" id="id3CD23959" position="2">
             <OSrc neg="True">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2586,7 +2825,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3D6E78AD" position="3">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3D6E78AD" position="3">
             <OSrc neg="True">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2606,7 +2846,8 @@
               <ServiceRef ref="tcp-HTTP"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3B1328FB" position="4">
+          </NATRule>
+          <NATRule disabled="False" id="id3B1328FB" position="4">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2626,7 +2867,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3E7ABEEA" position="5">
+          </NATRule>
+          <NATRule disabled="False" id="id3E7ABEEA" position="5">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2647,7 +2889,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3AF5AAD3" position="6">
+          </NATRule>
+          <NATRule disabled="False" id="id3AF5AAD3" position="6">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2667,7 +2910,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3D6E7B3D" position="7">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3D6E7B3D" position="7">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2687,7 +2931,8 @@
               <ServiceRef ref="tcp-HTTP"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3CCA1B57" position="8">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3CCA1B57" position="8">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2707,7 +2952,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3EB38983" position="9">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3EB38983" position="9">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2728,7 +2974,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3B50F7CB" position="10">
+          </NATRule>
+          <NATRule disabled="False" id="id3B50F7CB" position="10">
             <OSrc neg="True">
               <ObjectRef ref="id3B022266"/>
             </OSrc>
@@ -2748,7 +2995,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3BD8D94B" position="11">
+          </NATRule>
+          <NATRule disabled="False" id="id3BD8D94B" position="11">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2768,7 +3016,8 @@
               <ServiceRef ref="id3B5009F7"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3BD8D9DD" position="12">
+          </NATRule>
+          <NATRule disabled="False" id="id3BD8D9DD" position="12">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -2788,7 +3037,8 @@
               <ServiceRef ref="id3B5009F7"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3BBC0EA4" position="13">
+          </NATRule>
+          <NATRule disabled="False" id="id3BBC0EA4" position="13">
             <OSrc neg="False">
               <ObjectRef ref="id3B4572AF"/>
             </OSrc>
@@ -2808,7 +3058,8 @@
               <ServiceRef ref="id3B5009F7"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3BBC0F93" position="14">
+          </NATRule>
+          <NATRule disabled="False" id="id3BBC0F93" position="14">
             <OSrc neg="True">
               <ObjectRef ref="id3B4572AF"/>
             </OSrc>
@@ -2828,7 +3079,8 @@
               <ServiceRef ref="id3B5009F7"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3BC6BCE5" position="15">
+          </NATRule>
+          <NATRule disabled="False" id="id3BC6BCE5" position="15">
             <OSrc neg="True">
               <ObjectRef ref="host-hostA"/>
             </OSrc>
@@ -2848,7 +3100,8 @@
               <ServiceRef ref="id3B5009F7"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3D331552" position="16">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3D331552" position="16">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2872,7 +3125,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3EB38BC6" position="17">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3EB38BC6" position="17">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2893,7 +3147,8 @@
               <ServiceRef ref="id3B5009F7"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3EB38A91" position="18">
+          </NATRule>
+          <NATRule disabled="False" id="id3EB38A91" position="18">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -2914,18 +3169,23 @@
               <ServiceRef ref="id3B5009F7"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule></NAT>
-          <Policy id="id3AF5AA0C" name="Policy">
+          </NATRule>
+        </NAT>
+        <Policy id="id3AF5AA0C" name="Policy">
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id3C5987DC" log="True" position="0">
             <Src neg="False">
               <ObjectRef ref="id3B4572B5"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="id3B4572B5"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3B457567"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3AF5AA96"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -2935,13 +3195,17 @@
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id3CD34BEF" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="id3B4572AF"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="id3B4572AF"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3B457567"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3AF5AA96"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -2952,13 +3216,17 @@
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3AF5AA0A"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3AF5AA99"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -2968,13 +3236,17 @@
           <PolicyRule action="Deny" comment="Anti-spoofing rule" direction="Outbound" disabled="False" id="id3AF5AAAB" log="True" position="3">
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3AF5AA99"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -2985,13 +3257,17 @@
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3AF5AA0A"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3AF5AA99"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -3001,13 +3277,17 @@
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id3D16D55D" log="False" position="5">
             <Src neg="False">
               <ObjectRef ref="id3B022266"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3B0B4BC8"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -3015,13 +3295,17 @@
           <PolicyRule action="Deny" comment="" direction="Inbound" disabled="False" id="id435D572226912" log="True" position="6">
             <Src neg="False">
               <ObjectRef ref="id3B022266"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="True">
+            </Srv>
+            <Itf neg="True">
               <ObjectRef ref="id3B0B4BC8"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -3032,14 +3316,18 @@
             <Src neg="False">
               <ObjectRef ref="id3B665643"/>
               <ObjectRef ref="id3DE71E90"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="True">
+            </Srv>
+            <Itf neg="True">
               <ObjectRef ref="id3AF5AA99"/>
               <ObjectRef ref="id3B11F434"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -3049,13 +3337,17 @@
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id3D16D51D" log="False" position="8">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3B0B4D35"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -3064,14 +3356,18 @@
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3AF5AA96"/>
               <ObjectRef ref="id3B0B4BC8"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -3082,14 +3378,18 @@
             <Src neg="True">
               <ObjectRef ref="id3B665643"/>
               <ObjectRef ref="id3DE71E90"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3AF5AA99"/>
               <ObjectRef ref="id3B11F434"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -3097,13 +3397,17 @@
           <PolicyRule action="Accounting" direction="Both" disabled="False" id="id3E728AD9" log="False" position="11">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -3113,13 +3417,17 @@
           <PolicyRule action="Deny" comment="" direction="Both" disabled="False" id="id3CCA26E4" log="True" position="12">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-TCP-SYN"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -3129,13 +3437,17 @@
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id3B9AB902" log="True" position="13">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="True">
+            </Dst>
+            <Srv neg="True">
               <ServiceRef ref="tcp-TCP-SYN"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -3145,13 +3457,17 @@
           <PolicyRule action="Accept" comment="hostF has the same IP address as firewal." direction="Both" disabled="False" id="id3AFC0F90" log="True" position="14">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3AFC191C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="icmp-ping_request"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -3160,13 +3476,17 @@
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -3175,20 +3495,24 @@
             <Src neg="True">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="icmp-Unreachables"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="limit_suffix">/minute</Option>
               <Option name="limit_value">10</Option>
-              <Option name="log_prefix"/>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
@@ -3196,24 +3520,28 @@
             <Src neg="True">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-HTTP"/>
               <ServiceRef ref="id3B4FED69"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="firewall_is_part_of_any_and_networks">False</Option>
               <Option name="limit_burst">0</Option>
               <Option name="limit_suffix">/minute</Option>
               <Option name="limit_value">10</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
@@ -3222,24 +3550,28 @@
             <Src neg="True">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-HTTP"/>
               <ServiceRef ref="id3B4FED69"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="firewall_is_part_of_any_and_networks">False</Option>
               <Option name="limit_burst">0</Option>
               <Option name="limit_suffix">/minute</Option>
               <Option name="limit_value">10</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">False</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
@@ -3248,13 +3580,17 @@
             <Src neg="True">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3AF5AA0A"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="icmp-Unreachables"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -3265,13 +3601,17 @@
             <Src neg="True">
               <ObjectRef ref="id3B022266"/>
               <ObjectRef ref="id3AF5AA0A"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -3282,13 +3622,17 @@
             <Src neg="True">
               <ObjectRef ref="id3B022266"/>
               <ObjectRef ref="id3AF5AA96"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -3299,14 +3643,18 @@
             <Src neg="False">
               <ObjectRef ref="id3DECF4EB"/>
               <ObjectRef ref="id3DECF622"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -3317,14 +3665,18 @@
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -3334,15 +3686,19 @@
           <PolicyRule action="Deny" comment="testing negation in service field" direction="Both" disabled="False" id="id3B021E6F" log="True" position="24">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
-            </Dst><Srv neg="True">
+            </Dst>
+            <Srv neg="True">
               <ServiceRef ref="tcp-SMTP"/>
               <ServiceRef ref="tcp-SSH"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -3352,15 +3708,19 @@
           <PolicyRule action="Accept" comment="testing negation in service field" direction="Both" disabled="False" id="id3CCA2CF4" log="True" position="25">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
-            </Dst><Srv neg="True">
+            </Dst>
+            <Srv neg="True">
               <ServiceRef ref="tcp-SMTP"/>
               <ServiceRef ref="tcp-SSH"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -3368,14 +3728,18 @@
           <PolicyRule action="Accept" comment="testing negation in service field" direction="Both" disabled="False" id="id3EA925F1" log="True" position="26">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
-            </Dst><Srv neg="True">
+            </Dst>
+            <Srv neg="True">
               <ServiceRef ref="tcp-SMTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -3383,14 +3747,18 @@
           <PolicyRule action="Accept" comment="testing negation in service field" direction="Both" disabled="False" id="id3EA9225C" log="True" position="27">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
-            </Dst><Srv neg="True">
+            </Dst>
+            <Srv neg="True">
               <ServiceRef ref="id3C1A5D46"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -3398,14 +3766,18 @@
           <PolicyRule action="Accept" comment="testing negation in service field" direction="Both" disabled="False" id="id4144E299" log="False" position="28">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
-            </Dst><Srv neg="True">
+            </Dst>
+            <Srv neg="True">
               <ServiceRef ref="id3C1A5D46"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -3413,14 +3785,18 @@
           <PolicyRule action="Accept" comment="testing negation in service field" direction="Both" disabled="False" id="id41449248" log="False" position="29">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
-            </Dst><Srv neg="True">
+            </Dst>
+            <Srv neg="True">
               <ServiceRef ref="tcp-HTTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="int-workhours"/>
             </When>
             <PolicyRuleOptions/>
@@ -3428,14 +3804,18 @@
           <PolicyRule action="Accept" comment="testing negation in service field" direction="Both" disabled="False" id="id414532F3" log="False" position="30">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-HTTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="True">
+            </Itf>
+            <When neg="True">
               <IntervalRef ref="int-workhours"/>
             </When>
             <PolicyRuleOptions/>
@@ -3443,14 +3823,18 @@
           <PolicyRule action="Accept" comment="testing negation in service field" direction="Both" disabled="False" id="id41449257" log="False" position="31">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
-            </Dst><Srv neg="True">
+            </Dst>
+            <Srv neg="True">
               <ServiceRef ref="tcp-HTTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="True">
+            </Itf>
+            <When neg="True">
               <IntervalRef ref="int-workhours"/>
             </When>
             <PolicyRuleOptions/>
@@ -3458,13 +3842,17 @@
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id4368F08A15884" log="False" position="32">
             <Src neg="False">
               <ObjectRef ref="id3AF5AA0A"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="id3AF5AA0A"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-HTTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -3473,14 +3861,18 @@
             <Src neg="False">
               <ObjectRef ref="id3AF5AA0A"/>
               <ObjectRef ref="id3B022266"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="id3AF5AA0A"/>
               <ObjectRef ref="net-Internal_net"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -3488,13 +3880,17 @@
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id3B45739A" log="True" position="34">
             <Src neg="False">
               <ObjectRef ref="id3B4572B5"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="id3B4572B5"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3B457567"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -3504,13 +3900,17 @@
           <PolicyRule action="Deny" comment="double negation rule" direction="Both" disabled="False" id="id4067B2C2" log="True" position="35">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="id3B4572AF"/>
-            </Dst><Srv neg="True">
+            </Dst>
+            <Srv neg="True">
               <ServiceRef ref="id4067B2CD"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -3520,14 +3920,18 @@
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id41A88DF6" log="False" position="36">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="id3AF5AA96"/>
               <ObjectRef ref="id3B0B4BC8"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -3536,13 +3940,17 @@
             <Src neg="True">
               <ObjectRef ref="id3AF5AA96"/>
               <ObjectRef ref="id3B0B4BC8"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -3550,13 +3958,17 @@
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id4143BD3F" log="False" position="38">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SMTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="True">
+            </Itf>
+            <When neg="True">
               <IntervalRef ref="id3C63479C"/>
               <IntervalRef ref="id3C63479E"/>
             </When>
@@ -3565,13 +3977,17 @@
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id4143BD1A" log="False" position="39">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-HTTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="True">
+            </Itf>
+            <When neg="True">
               <IntervalRef ref="int-workhours"/>
             </When>
             <PolicyRuleOptions/>
@@ -3579,13 +3995,17 @@
           <PolicyRule action="Accept" comment="'masquerading' rule" direction="Both" disabled="False" id="id3AF5AAC8" log="False" position="40">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -3593,97 +4013,102 @@
           <PolicyRule action="Deny" comment="testing combination&#10;of limit and logging" direction="Both" disabled="False" id="id42AB87C6" log="True" position="41">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="firewall_is_part_of_any_and_networks">False</Option>
               <Option name="limit_burst">0</Option>
               <Option name="limit_suffix">/second</Option>
               <Option name="limit_value">10</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
-              <Option name="rule_name_accounting"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id3AF5AA0A-routing" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="" dyn="False" id="id3AF5AA96" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.1" id="id3AF5AA96-ipv4" name="address" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3AF5AA99" name="eth1" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="22.22.22.22" id="id3AF5AA99-ipv4" name="address" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3B0B4BC8" name="eth2" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.2.1" id="id3B0B4BC8-ipv4" name="address" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3B0B4D35" name="lo" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="127.0.0.1" id="id3B0B4D35-ipv4" name="address" netmask="255.0.0.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3B11F434" name="eth3" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="22.22.23.23" id="id3B11F434-ipv4" name="address" netmask="255.255.255.0"/>
+        </Policy>
+        <Routing id="id3AF5AA0A-routing" name="Routing"/>
+        <Interface bridgeport="False" comment="" dyn="False" id="id3AF5AA96" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id3AF5AA96-ipv4" name="address" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-          <Management address="192.168.1.1">
+        <Interface bridgeport="False" dyn="False" id="id3AF5AA99" name="eth1" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id3AF5AA99-ipv4" name="address" address="22.22.22.22" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" dyn="False" id="id3B0B4BC8" name="eth2" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id3B0B4BC8-ipv4" name="address" address="192.168.2.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" dyn="False" id="id3B0B4D35" name="lo" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id3B0B4D35-ipv4" name="address" address="127.0.0.1" netmask="255.0.0.0"/>
+        </Interface>
+        <Interface bridgeport="False" dyn="False" id="id3B11F434" name="eth3" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id3B11F434-ipv4" name="address" address="22.22.23.23" netmask="255.255.255.0"/>
+        </Interface>
+        <Management address="192.168.1.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">True</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">True</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="epilog_script"/>
-          <Option name="firewall_dir"/>
+          <Option name="epilog_script"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/second</Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">False</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -3693,24 +4118,24 @@
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="platform">iptables</Option>
           <Option name="prolog_place">after_interfaces</Option>
-          <Option name="prolog_script"/>
+          <Option name="prolog_script"></Option>
           <Option name="proxy_arp">False</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
-          <Option name="sshArgs"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -3720,7 +4145,7 @@
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="this object has several interfaces and shows different rules for NAT. Also testing policy rule options " host_OS="linux24" id="id3AFB66C6" inactive="False" lastCompiled="1188315148" lastInstalled="1142003872" lastModified="1211435422" name="firewall2" platform="iptables" ro="False" version="">
         <NAT id="id3AFB66C7" name="NAT">
           <NATRule disabled="False" id="id3AFB66C8" position="0">
@@ -3743,9 +4168,10 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </NATRuleOptions>
-          </NATRule><NATRule comment="" disabled="False" id="id3F3E9BB6" position="1">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3F3E9BB6" position="1">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -3766,9 +4192,10 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </NATRuleOptions>
-          </NATRule><NATRule comment="" disabled="False" id="id3F3E9D62" position="2">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3F3E9D62" position="2">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -3791,9 +4218,10 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </NATRuleOptions>
-          </NATRule><NATRule comment="" disabled="False" id="id3D8F5820" position="3">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3D8F5820" position="3">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -3813,9 +4241,10 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </NATRuleOptions>
-          </NATRule><NATRule comment="" disabled="False" id="id3D8F5A56" position="4">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3D8F5A56" position="4">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -3835,9 +4264,10 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </NATRuleOptions>
-          </NATRule><NATRule comment="" disabled="False" id="id48356E1314854" position="5">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id48356E1314854" position="5">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -3857,9 +4287,10 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </NATRuleOptions>
-          </NATRule><NATRule disabled="False" id="id3AFB66D6" position="6">
+          </NATRule>
+          <NATRule disabled="False" id="id3AFB66D6" position="6">
             <OSrc neg="False">
               <ObjectRef ref="host-hostA"/>
             </OSrc>
@@ -3879,9 +4310,10 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </NATRuleOptions>
-          </NATRule><NATRule comment="" disabled="False" id="id3DE47CAD" position="7">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3DE47CAD" position="7">
             <OSrc neg="False">
               <ObjectRef ref="host-hostA"/>
             </OSrc>
@@ -3901,9 +4333,10 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </NATRuleOptions>
-          </NATRule><NATRule disabled="False" id="id3CABE6DF" position="8">
+          </NATRule>
+          <NATRule disabled="False" id="id3CABE6DF" position="8">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -3924,7 +4357,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3D1519E8" position="9">
+          </NATRule>
+          <NATRule disabled="False" id="id3D1519E8" position="9">
             <OSrc neg="False">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
@@ -3948,7 +4382,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3D151BA0" position="10">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3D151BA0" position="10">
             <OSrc neg="False">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
@@ -3970,7 +4405,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3AFB69BD" position="11">
+          </NATRule>
+          <NATRule disabled="False" id="id3AFB69BD" position="11">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -3994,7 +4430,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3E76DDFF" position="12">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3E76DDFF" position="12">
             <OSrc neg="False">
               <ObjectRef ref="id3AFB66C6"/>
             </OSrc>
@@ -4016,7 +4453,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3E76DE15" position="13">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3E76DE15" position="13">
             <OSrc neg="False">
               <ObjectRef ref="id3AFB68D2"/>
             </OSrc>
@@ -4037,7 +4475,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3E76DF9A" position="14">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3E76DF9A" position="14">
             <OSrc neg="False">
               <ObjectRef ref="id3AFB66C6"/>
               <ObjectRef ref="id3B19C5EB"/>
@@ -4059,7 +4498,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="True" id="id3DEA75AF" position="15">
+          </NATRule>
+          <NATRule comment="" disabled="True" id="id3DEA75AF" position="15">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4080,7 +4520,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3DE47C72" position="16">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3DE47C72" position="16">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4101,7 +4542,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3BEEF6D2" position="17">
+          </NATRule>
+          <NATRule disabled="False" id="id3BEEF6D2" position="17">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4121,7 +4563,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3BD67563" position="18">
+          </NATRule>
+          <NATRule disabled="False" id="id3BD67563" position="18">
             <OSrc neg="False">
               <ObjectRef ref="host-hostB"/>
             </OSrc>
@@ -4141,9 +4584,10 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </NATRuleOptions>
-          </NATRule><NATRule disabled="False" id="id3BD6757E" position="19">
+          </NATRule>
+          <NATRule disabled="False" id="id3BD6757E" position="19">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4163,7 +4607,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id4368AD8715884" position="20">
+          </NATRule>
+          <NATRule disabled="False" id="id4368AD8715884" position="20">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -4183,7 +4628,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="NETMAP " disabled="False" id="id3B66568B" position="21">
+          </NATRule>
+          <NATRule comment="NETMAP " disabled="False" id="id3B66568B" position="21">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -4203,7 +4649,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="NETMAP" disabled="False" id="id3B6656EF" position="22">
+          </NATRule>
+          <NATRule comment="NETMAP" disabled="False" id="id3B6656EF" position="22">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4223,7 +4670,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3AFB69F7" position="23">
+          </NATRule>
+          <NATRule disabled="False" id="id3AFB69F7" position="23">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4243,7 +4691,8 @@
               <ServiceRef ref="id3B20468D"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id446BA34525148" position="24">
+          </NATRule>
+          <NATRule disabled="False" id="id446BA34525148" position="24">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4264,7 +4713,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3B7313C4" position="25">
+          </NATRule>
+          <NATRule disabled="False" id="id3B7313C4" position="25">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4284,7 +4734,8 @@
               <ServiceRef ref="tcp-SMTP"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3E04C979" position="26">
+          </NATRule>
+          <NATRule disabled="False" id="id3E04C979" position="26">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4305,7 +4756,8 @@
               <ServiceRef ref="id3B4FF09A"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3E74F756" position="27">
+          </NATRule>
+          <NATRule disabled="False" id="id3E74F756" position="27">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4325,7 +4777,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3E74F620" position="28">
+          </NATRule>
+          <NATRule disabled="False" id="id3E74F620" position="28">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4349,7 +4802,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="transparent proxy rule" disabled="False" id="id3FB3526D" position="29">
+          </NATRule>
+          <NATRule comment="transparent proxy rule" disabled="False" id="id3FB3526D" position="29">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -4369,7 +4823,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="True" id="id402335CD" position="30">
+          </NATRule>
+          <NATRule comment="" disabled="True" id="id402335CD" position="30">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4390,7 +4845,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3FC6531F" position="31">
+          </NATRule>
+          <NATRule disabled="False" id="id3FC6531F" position="31">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4410,7 +4866,8 @@
               <ServiceRef ref="id3DDDE4E4"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id40F2F9C1" position="32">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id40F2F9C1" position="32">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -4430,7 +4887,8 @@
               <ServiceRef ref="id3DDDE4E4"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id407EDDBD" position="33">
+          </NATRule>
+          <NATRule disabled="False" id="id407EDDBD" position="33">
             <OSrc neg="False">
               <ObjectRef ref="host-hostA"/>
             </OSrc>
@@ -4450,7 +4908,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id407EDE37" position="34">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id407EDE37" position="34">
             <OSrc neg="True">
               <ObjectRef ref="host-hostA"/>
             </OSrc>
@@ -4470,7 +4929,8 @@
               <ServiceRef ref="id3B4FF09A"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id40F195C3" position="35">
+          </NATRule>
+          <NATRule disabled="False" id="id40F195C3" position="35">
             <OSrc neg="True">
               <ObjectRef ref="id3B4572AF"/>
             </OSrc>
@@ -4490,7 +4950,8 @@
               <ServiceRef ref="id3B4FF09A"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id40F1C52F" position="36">
+          </NATRule>
+          <NATRule disabled="False" id="id40F1C52F" position="36">
             <OSrc neg="True">
               <ObjectRef ref="id3B4572AF"/>
             </OSrc>
@@ -4510,7 +4971,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id407EDCD5" position="37">
+          </NATRule>
+          <NATRule disabled="False" id="id407EDCD5" position="37">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -4530,7 +4992,8 @@
               <ServiceRef ref="id3B4FF09A"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="this is the &quot;exception&quot; rule&#10;used in support req. originally" disabled="False" id="id46D6DA2024736" position="38">
+          </NATRule>
+          <NATRule comment="this is the &quot;exception&quot; rule&#10;used in support req. originally" disabled="False" id="id46D6DA2024736" position="38">
             <OSrc neg="False">
               <ObjectRef ref="id3B4572AF"/>
             </OSrc>
@@ -4552,7 +5015,8 @@
             <NATRuleOptions>
               <Option name="color">#C08B5A</Option>
             </NATRuleOptions>
-          </NATRule><NATRule disabled="False" id="id46D6DA3124736" position="39">
+          </NATRule>
+          <NATRule disabled="False" id="id46D6DA3124736" position="39">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -4574,7 +5038,8 @@
             <NATRuleOptions>
               <Option name="color">#C08B5A</Option>
             </NATRuleOptions>
-          </NATRule><NATRule comment="&quot;exception&quot; rule in the pair&#10;from a support req." disabled="False" id="id46D49F4824736" position="40">
+          </NATRule>
+          <NATRule comment="&quot;exception&quot; rule in the pair&#10;from a support req." disabled="False" id="id46D49F4824736" position="40">
             <OSrc neg="False">
               <ObjectRef ref="id3B4572AF"/>
             </OSrc>
@@ -4596,7 +5061,8 @@
             <NATRuleOptions>
               <Option name="color">#8BC065</Option>
             </NATRuleOptions>
-          </NATRule><NATRule comment="testing transparent proxy&#10;roules for a support req." disabled="False" id="id46D67A4324736" position="41">
+          </NATRule>
+          <NATRule comment="testing transparent proxy&#10;roules for a support req." disabled="False" id="id46D67A4324736" position="41">
             <OSrc neg="True">
               <ObjectRef ref="id3B4572AF"/>
             </OSrc>
@@ -4618,7 +5084,8 @@
             <NATRuleOptions>
               <Option name="color">#8BC065</Option>
             </NATRuleOptions>
-          </NATRule><NATRule comment="testing transparent proxy&#10;roules for a support req." disabled="False" id="id46D67A5924736" position="42">
+          </NATRule>
+          <NATRule comment="testing transparent proxy&#10;roules for a support req." disabled="False" id="id46D67A5924736" position="42">
             <OSrc neg="True">
               <ObjectRef ref="id3B4572AF"/>
             </OSrc>
@@ -4640,7 +5107,8 @@
             <NATRuleOptions>
               <Option name="color">#8BC065</Option>
             </NATRuleOptions>
-          </NATRule><NATRule comment="testing transparent proxy&#10;roules for a support req." disabled="False" id="id46D49F3624736" position="43">
+          </NATRule>
+          <NATRule comment="testing transparent proxy&#10;roules for a support req." disabled="False" id="id46D49F3624736" position="43">
             <OSrc neg="True">
               <ObjectRef ref="id3B4572AF"/>
             </OSrc>
@@ -4662,7 +5130,8 @@
             <NATRuleOptions>
               <Option name="color">#8BC065</Option>
             </NATRuleOptions>
-          </NATRule><NATRule comment="&quot;exception&quot; rule in the pair&#10;from a support req." disabled="False" id="id46D6AA1B24736" position="44">
+          </NATRule>
+          <NATRule comment="&quot;exception&quot; rule in the pair&#10;from a support req." disabled="False" id="id46D6AA1B24736" position="44">
             <OSrc neg="False">
               <ObjectRef ref="id3B4572AF"/>
             </OSrc>
@@ -4684,7 +5153,8 @@
             <NATRuleOptions>
               <Option name="color">#C0BA44</Option>
             </NATRuleOptions>
-          </NATRule><NATRule comment="testing transparent proxy&#10;roules for a support req." disabled="False" id="id46D6AA2F24736" position="45">
+          </NATRule>
+          <NATRule comment="testing transparent proxy&#10;roules for a support req." disabled="False" id="id46D6AA2F24736" position="45">
             <OSrc neg="True">
               <ObjectRef ref="id3B4572AF"/>
             </OSrc>
@@ -4706,24 +5176,29 @@
             <NATRuleOptions>
               <Option name="color">#C0BA44</Option>
             </NATRuleOptions>
-          </NATRule></NAT>
-          <Policy id="id3AFB66E4" name="Policy">
+          </NATRule>
+        </NAT>
+        <Policy id="id3AFB66E4" name="Policy">
           <PolicyRule action="Deny" comment="Anti-spoofing rule" direction="Inbound" disabled="False" id="id3AFB6708" log="True" position="0">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3AFB66C6"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3AFB6706"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
               <Option name="log_prefix">Iface: %I RULE %N -- %A **</Option>
               <Option name="stateless">True</Option>
@@ -4733,18 +5208,22 @@
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3AFB66C6"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3AFB6706"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
               <Option name="log_prefix">Iface: %I RULE %N -- %A **</Option>
               <Option name="stateless">True</Option>
@@ -4753,30 +5232,34 @@
           <PolicyRule action="Deny" comment="testing group in &quot;interface&quot;&#10;this rule should be identical to rule 3&#10;" direction="Inbound" disabled="False" id="id44C0660013221" log="True" position="2">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sg-DHCP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id4653B4A820440"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="connlimit_masklen">0</Option>
               <Option name="connlimit_value">0</Option>
               <Option name="firewall_is_part_of_any_and_networks">False</Option>
               <Option name="hashlimit_burst">0</Option>
               <Option name="hashlimit_dstlimit">False</Option>
               <Option name="hashlimit_mode">dstip</Option>
-              <Option name="hashlimit_suffix"/>
+              <Option name="hashlimit_suffix"></Option>
               <Option name="hashlimit_value">0</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
@@ -4784,31 +5267,35 @@
           <PolicyRule action="Deny" comment="" direction="Inbound" disabled="False" id="id4653E36120440" log="True" position="3">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sg-DHCP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3AFB6706"/>
               <ObjectRef ref="id3AFB68D2"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="connlimit_masklen">0</Option>
               <Option name="connlimit_value">0</Option>
               <Option name="firewall_is_part_of_any_and_networks">False</Option>
               <Option name="hashlimit_burst">0</Option>
               <Option name="hashlimit_dstlimit">False</Option>
               <Option name="hashlimit_mode">dstip</Option>
-              <Option name="hashlimit_suffix"/>
+              <Option name="hashlimit_suffix"></Option>
               <Option name="hashlimit_value">0</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
@@ -4816,14 +5303,18 @@
           <PolicyRule action="Accept" comment="testing choice of chains in case when several&#10;interfaces are used and rule matches 'any' or&#10;broadcast &#10;" direction="Both" disabled="False" id="id44C0691E13221" log="False" position="4">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3F6D115C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sg-DHCP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3AFB6706"/>
               <ObjectRef ref="id3AFB68D2"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -4831,14 +5322,18 @@
           <PolicyRule action="Accept" comment="" direction="Inbound" disabled="False" id="id44C0694513221" log="False" position="5">
             <Src neg="False">
               <ObjectRef ref="id44C0695713221"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3F6D115C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sg-DHCP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3AFB6706"/>
               <ObjectRef ref="id3AFB68D2"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -4846,14 +5341,18 @@
           <PolicyRule action="Accept" comment="" direction="Outbound" disabled="False" id="id44C092DD13221" log="False" position="6">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3F6D115C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sg-DHCP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3AFB6706"/>
               <ObjectRef ref="id3AFB68D2"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -4861,13 +5360,17 @@
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id3D6748D9" log="True" position="7">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="True">
+            </Dst>
+            <Srv neg="True">
               <ServiceRef ref="tcp-TCP-SYN"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -4877,35 +5380,43 @@
           <PolicyRule action="Deny" comment="block fragments" direction="Both" disabled="False" id="id3AFB66E5" log="True" position="8">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="ip-IP_Fragments"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Reject" comment="sends TCP RST and makes custom record&#10;in the log" direction="Both" disabled="False" id="id3B0C6FD2" log="True" position="9">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-Auth"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="action_on_reject">TCP RST</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
               <Option name="log_prefix">IDENT</Option>
               <Option name="stateless">True</Option>
@@ -4914,34 +5425,42 @@
           <PolicyRule action="Reject" direction="Both" disabled="False" id="id3D293D84" log="True" position="10">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="udp-SNMP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="action_on_reject">TCP RST</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id3DD1E1E0" log="True" position="11">
             <Src neg="False">
               <ObjectRef ref="id3B022266"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B0221F1"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3C1A5D46"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -4950,13 +5469,17 @@
             <Src neg="False">
               <ObjectRef ref="id3B4572AF"/>
               <ObjectRef ref="id3D8FC56A"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="host-secondary1-com"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -4964,14 +5487,18 @@
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id3D8FC984" log="False" position="13">
             <Src neg="False">
               <ObjectRef ref="host-secondary1-com"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B4572AF"/>
               <ObjectRef ref="id3D8FC56A"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -4980,13 +5507,17 @@
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -4997,13 +5528,17 @@
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -5011,13 +5546,17 @@
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id3DD4C015" log="True" position="16">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -5027,34 +5566,42 @@
           <PolicyRule action="Accept" comment="host-fw2 has the same address as &#10;        one of the firewall's interfaces" direction="Both" disabled="False" id="id3C447B8D" log="True" position="17">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3AFC0F70"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-FTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="limit_burst">10</Option>
               <Option name="limit_suffix">/minute</Option>
               <Option name="limit_value">5</Option>
-              <Option name="log_prefix"/>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id3C447BCB" log="True" position="18">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3AFB66C6"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-FTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -5062,93 +5609,98 @@
           <PolicyRule action="Deny" comment="'catch all' rule" direction="Both" disabled="False" id="id3AFB66F9" log="True" position="19">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id3AFB66C6-routing" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="" dyn="False" id="id3AFB6703" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.1" comment="" id="id3AFB6703-ipv4" name="fw2:eth0:ip - internal" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3AFB6706" name="eth1" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="22.22.22.22" comment="" id="id3AFB6706-ipv4" name="fw2:eth1:ip - external" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id3AFB68D2" label="" mgmt="False" name="eth3" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="22.22.23.23" comment="" id="id3AFB68D2-ipv4" name="fw2:eth3:0" netmask="255.255.255.0"/>
-          <IPv4 address="22.22.25.50" comment="" id="id3D5DEADC" name="fw2:eth3:1" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3B0221F1" name="eth2" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.2.1" comment="" id="id3B0221F1-ipv4" name="fw2:eth2:1" netmask="255.255.255.0"/>
-          <IPv4 address="192.168.2.40" comment="" id="id3DD1E161" name="fw2:eth2:2" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3CD2449F" label="" name="lo" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="127.0.0.1" id="id3CD2449F-ipv4" name="address" netmask="255.0.0.0"/>
+        </Policy>
+        <Routing id="id3AFB66C6-routing" name="Routing"/>
+        <Interface bridgeport="False" comment="" dyn="False" id="id3AFB6703" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id3AFB6703-ipv4" name="fw2:eth0:ip - internal" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-          <Management address="192.168.1.1">
+        <Interface bridgeport="False" dyn="False" id="id3AFB6706" name="eth1" security_level="0" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id3AFB6706-ipv4" name="fw2:eth1:ip - external" address="22.22.22.22" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" comment="" dyn="False" id="id3AFB68D2" label="" mgmt="False" name="eth3" security_level="0" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id3AFB68D2-ipv4" name="fw2:eth3:0" address="22.22.23.23" netmask="255.255.255.0"/>
+          <IPv4 comment="" id="id3D5DEADC" name="fw2:eth3:1" address="22.22.25.50" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" dyn="False" id="id3B0221F1" name="eth2" security_level="100" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id3B0221F1-ipv4" name="fw2:eth2:1" address="192.168.2.1" netmask="255.255.255.0"/>
+          <IPv4 comment="" id="id3DD1E161" name="fw2:eth2:2" address="192.168.2.40" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" dyn="False" id="id3CD2449F" label="" name="lo" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id3CD2449F-ipv4" name="address" address="127.0.0.1" netmask="255.0.0.0"/>
+        </Interface>
+        <Management address="192.168.1.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">False</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">True</Option>
           <Option name="classify_mark_terminating">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">True</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="epilog_script"/>
-          <Option name="firewall_dir"/>
+          <Option name="epilog_script"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
-          <Option name="id"/>
+          <Option name="id"></Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/second</Option>
           <Option name="limit_value">5</Option>
           <Option name="linux24_accept_redirects">0</Option>
           <Option name="linux24_accept_source_route">0</Option>
           <Option name="linux24_icmp_echo_ignore_all">1</Option>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
           <Option name="linux24_icmp_ignore_bogus_error_responses">1</Option>
-          <Option name="linux24_ip_dynaddr"/>
+          <Option name="linux24_ip_dynaddr"></Option>
           <Option name="linux24_ip_forward">1</Option>
           <Option name="linux24_log_martians">1</Option>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
           <Option name="linux24_rp_filter">1</Option>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">False</Option>
           <Option name="local_nat">True</Option>
           <Option name="log_all">False</Option>
@@ -5162,21 +5714,21 @@
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_ipv6_default_policy">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="platform">iptables</Option>
           <Option name="prolog_place">after_flush</Option>
-          <Option name="prolog_script"/>
+          <Option name="prolog_script"></Option>
           <Option name="proxy_arp">True</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
-          <Option name="sshArgs"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -5187,7 +5739,7 @@
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="this object is used to test negation in policy rules with &quot;Assume firewall is part of 'Any'&quot; turned OFF" host_OS="linux24" id="id3B0226B6" inactive="False" lastCompiled="1196093755" lastInstalled="1142003872" lastModified="1196093903" name="firewall3" platform="iptables" ro="False" version="">
         <NAT id="id3B0226B7" name="NAT">
           <NATRule disabled="False" id="id3B0226B8" position="0">
@@ -5210,9 +5762,10 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </NATRuleOptions>
-          </NATRule><NATRule disabled="False" id="id3B0226C6" position="1">
+          </NATRule>
+          <NATRule disabled="False" id="id3B0226C6" position="1">
             <OSrc neg="False">
               <ObjectRef ref="host-hostA"/>
             </OSrc>
@@ -5232,20 +5785,25 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </NATRuleOptions>
-          </NATRule></NAT>
-          <Policy id="id3B0226D4" name="Policy">
+          </NATRule>
+        </NAT>
+        <Policy id="id3B0226D4" name="Policy">
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id44C3826813221" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id465D5AF12072"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -5253,13 +5811,17 @@
           <PolicyRule action="Deny" direction="Inbound" disabled="False" id="id3B02270E" log="True" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="ip-IP_Fragments"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3B02270C"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -5269,30 +5831,34 @@
           <PolicyRule action="Deny" comment="" direction="Inbound" disabled="False" id="id44C2868B13221" log="True" position="2">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sg-DHCP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3B02270A"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="connlimit_masklen">0</Option>
               <Option name="connlimit_value">0</Option>
               <Option name="firewall_is_part_of_any_and_networks">False</Option>
               <Option name="hashlimit_burst">0</Option>
               <Option name="hashlimit_dstlimit">False</Option>
               <Option name="hashlimit_mode">dstip</Option>
-              <Option name="hashlimit_suffix"/>
+              <Option name="hashlimit_suffix"></Option>
               <Option name="hashlimit_value">0</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
@@ -5300,31 +5866,35 @@
           <PolicyRule action="Deny" comment="" direction="Inbound" disabled="False" id="id44C1B5A613221" log="True" position="3">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sg-DHCP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3B02270A"/>
               <ObjectRef ref="id3B0B57D2"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="connlimit_masklen">0</Option>
               <Option name="connlimit_value">0</Option>
               <Option name="firewall_is_part_of_any_and_networks">False</Option>
               <Option name="hashlimit_burst">0</Option>
               <Option name="hashlimit_dstlimit">False</Option>
               <Option name="hashlimit_mode">dstip</Option>
-              <Option name="hashlimit_suffix"/>
+              <Option name="hashlimit_suffix"></Option>
               <Option name="hashlimit_value">0</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
@@ -5332,13 +5902,17 @@
           <PolicyRule action="Accept" comment="testing choice of chains in case when several interfaces&#10;are used and rule matches on any or broadcast &#10;" direction="Both" disabled="False" id="id44C286B713221" log="False" position="4">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3F6D115C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sg-DHCP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3B02270A"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -5346,14 +5920,18 @@
           <PolicyRule action="Accept" comment="testing choice of chains in case when several interfaces&#10;are used and rule matches on any or broadcast &#10;" direction="Both" disabled="False" id="id44C1B5B813221" log="False" position="5">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3F6D115C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sg-DHCP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3B02270A"/>
               <ObjectRef ref="id3B0B57D2"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -5361,13 +5939,17 @@
           <PolicyRule action="Accept" comment="" direction="Inbound" disabled="False" id="id44C286E313221" log="False" position="6">
             <Src neg="False">
               <ObjectRef ref="id44C0695713221"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3F6D115C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sg-DHCP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3B02270A"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -5375,14 +5957,18 @@
           <PolicyRule action="Accept" comment="" direction="Inbound" disabled="False" id="id44C1B5CA13221" log="False" position="7">
             <Src neg="False">
               <ObjectRef ref="id44C0695713221"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3F6D115C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sg-DHCP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3B02270A"/>
               <ObjectRef ref="id3B0B57D2"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -5390,13 +5976,17 @@
           <PolicyRule action="Accept" comment="" direction="Outbound" disabled="False" id="id44C2870F13221" log="False" position="8">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3F6D115C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sg-DHCP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3B02270A"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -5404,14 +5994,18 @@
           <PolicyRule action="Accept" comment="" direction="Outbound" disabled="False" id="id44C1B5DC13221" log="False" position="9">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3F6D115C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sg-DHCP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3B02270A"/>
               <ObjectRef ref="id3B0B57D2"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -5420,13 +6014,17 @@
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B0226B6"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3B02270C"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -5437,13 +6035,17 @@
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B0226B6"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3B02270C"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -5453,29 +6055,37 @@
           <PolicyRule action="Accept" comment="hostF has the same IP address as firewal." direction="Both" disabled="False" id="id3B0226D5" log="True" position="12">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3AFC191C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="icmp-ping_request"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id3B022A81" log="False" position="13">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B0226B6"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -5484,30 +6094,38 @@
             <Src neg="True">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="icmp-Unreachables"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id40F57E67" log="False" position="15">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="id3B665643"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -5515,13 +6133,17 @@
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id40F57E72" log="False" position="16">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="id40F57E7C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -5529,14 +6151,18 @@
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id41A8EF1D" log="False" position="17">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="id3B02270A"/>
               <ObjectRef ref="id3B0B57D2"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -5544,65 +6170,81 @@
           <PolicyRule action="Deny" comment="testing negation in service field" direction="Both" disabled="False" id="id3B0226EA" log="True" position="18">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
-            </Dst><Srv neg="True">
+            </Dst>
+            <Srv neg="True">
               <ServiceRef ref="tcp-SMTP"/>
               <ServiceRef ref="tcp-SSH"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Accept" comment="'masquerading' rule" direction="Both" disabled="False" id="id3B0226F6" log="False" position="19">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Deny" comment="'catch all' rule" direction="Both" disabled="False" id="id3B022700" log="True" position="20">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id440D600617760" log="False" position="21">
             <Src neg="True">
               <ObjectRef ref="id3B0226B6"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -5610,13 +6252,17 @@
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id440D880417760" log="False" position="22">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="id3B0226B6"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -5624,89 +6270,93 @@
           <PolicyRule action="Accept" comment="this rule should go only to the FORWARD&#10;chain but should have &quot;-i eth&quot; clause&#10;" direction="Inbound" disabled="False" id="id474B57834682" log="False" position="23">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3B02270C"/>
               <ObjectRef ref="id3B02270A"/>
               <ObjectRef ref="id3B0B57D2"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id3B0226B6-routing" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="" dyn="False" id="id3B02270A" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.1" id="id3B02270A-ipv4" name="address" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3B02270C" name="eth1" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="22.22.22.22" id="id3B02270C-ipv4" name="address" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3B0B57D2" name="eth2" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.2.1" id="id3B0B57D2-ipv4" name="address" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id465D5AF12072" label="" mgmt="False" name="lo" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="127.0.0.1" comment="" id="id465D89B62072" name="firewall3:lo:ip" netmask="255.0.0.0"/>
+        </Policy>
+        <Routing id="id3B0226B6-routing" name="Routing"/>
+        <Interface bridgeport="False" comment="" dyn="False" id="id3B02270A" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id3B02270A-ipv4" name="address" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-          <Management address="192.168.1.1">
+        <Interface bridgeport="False" dyn="False" id="id3B02270C" name="eth1" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id3B02270C-ipv4" name="address" address="22.22.22.22" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" dyn="False" id="id3B0B57D2" name="eth2" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id3B0B57D2-ipv4" name="address" address="192.168.2.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" comment="" dyn="False" id="id465D5AF12072" label="" mgmt="False" name="lo" security_level="100" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id465D89B62072" name="firewall3:lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
+        </Interface>
+        <Management address="192.168.1.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">False</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="epilog_script"/>
-          <Option name="firewall_dir"/>
+          <Option name="epilog_script"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">False</Option>
           <Option name="firewall_is_part_of_any_and_networks">False</Option>
-          <Option name="id"/>
+          <Option name="id"></Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
-          <Option name="limit_suffix"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
+          <Option name="limit_suffix"></Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">False</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -5716,24 +6366,24 @@
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">False</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="no_iochains_for_any">True</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="platform">iptables</Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"/>
+          <Option name="prolog_script"></Option>
           <Option name="proxy_arp">False</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
-          <Option name="sshArgs"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -5742,7 +6392,7 @@
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="this object is used to test a configuration where firewall has dynamic address " host_OS="linux24" id="id3B0C6380" inactive="False" lastCompiled="1188097179" lastInstalled="1142003872" lastModified="1184801731" name="firewall4" platform="iptables" ro="False" version="">
         <NAT id="id3B0C6381" name="NAT">
           <NATRule disabled="False" id="id3B0C6382" position="0">
@@ -5765,9 +6415,10 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </NATRuleOptions>
-          </NATRule><NATRule disabled="False" id="id3DECF530" position="1">
+          </NATRule>
+          <NATRule disabled="False" id="id3DECF530" position="1">
             <OSrc neg="False">
               <ObjectRef ref="host-hostA"/>
             </OSrc>
@@ -5787,7 +6438,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3DECF6DA" position="2">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3DECF6DA" position="2">
             <OSrc neg="False">
               <ObjectRef ref="host-hostA"/>
             </OSrc>
@@ -5807,7 +6459,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3B0C6390" position="3">
+          </NATRule>
+          <NATRule disabled="False" id="id3B0C6390" position="3">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -5827,9 +6480,10 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </NATRuleOptions>
-          </NATRule><NATRule disabled="False" id="id3DCA1BE7" position="4">
+          </NATRule>
+          <NATRule disabled="False" id="id3DCA1BE7" position="4">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B0C6380"/>
@@ -5850,7 +6504,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3B202AFF" position="5">
+          </NATRule>
+          <NATRule disabled="False" id="id3B202AFF" position="5">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -5870,7 +6525,8 @@
               <ServiceRef ref="tcp-SSH"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3E2529F3" position="6">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3E2529F3" position="6">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -5890,19 +6546,24 @@
               <ServiceRef ref="tcp-SSH"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule></NAT>
-          <Policy id="id3B0C639E" name="Policy">
+          </NATRule>
+        </NAT>
+        <Policy id="id3B0C639E" name="Policy">
           <PolicyRule action="Deny" comment="Anti-spoofing rule" direction="Inbound" disabled="False" id="id3B0C63E3" log="True" position="0">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B0C6380"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3B0C63E1"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -5913,13 +6574,17 @@
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B0C6380"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3B0C63E1"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -5929,13 +6594,17 @@
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id3B54F071" log="True" position="2">
             <Src neg="True">
               <ObjectRef ref="id3B022266"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="icmp-ping_request"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3B0C63E1"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -5945,13 +6614,17 @@
           <PolicyRule action="Accept" direction="Inbound" disabled="False" id="id3E49FEF2" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B0C6380"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3B0C63E1"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -5959,13 +6632,17 @@
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id3B54C977" log="True" position="4">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="icmp-ping_request"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3B0C63E1"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -5975,13 +6652,17 @@
           <PolicyRule action="Accept" comment="OUTPUT" direction="Outbound" disabled="False" id="id469EDB0514508" log="False" position="5">
             <Src neg="False">
               <ObjectRef ref="id3B0C6380"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id44F7082928576"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -5995,15 +6676,15 @@
               <Option name="hashlimit_gcinterval">0</Option>
               <Option name="hashlimit_max">0</Option>
               <Option name="hashlimit_mode">dstip</Option>
-              <Option name="hashlimit_name"/>
+              <Option name="hashlimit_name"></Option>
               <Option name="hashlimit_size">0</Option>
-              <Option name="hashlimit_suffix"/>
+              <Option name="hashlimit_suffix"></Option>
               <Option name="hashlimit_value">0</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
@@ -6011,13 +6692,17 @@
           <PolicyRule action="Accept" comment="INTPUT" direction="Inbound" disabled="False" id="id469F02B014773" log="False" position="6">
             <Src neg="False">
               <ObjectRef ref="id44F7082928576"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B0C6380"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -6031,15 +6716,15 @@
               <Option name="hashlimit_gcinterval">0</Option>
               <Option name="hashlimit_max">0</Option>
               <Option name="hashlimit_mode">dstip</Option>
-              <Option name="hashlimit_name"/>
+              <Option name="hashlimit_name"></Option>
               <Option name="hashlimit_size">0</Option>
-              <Option name="hashlimit_suffix"/>
+              <Option name="hashlimit_suffix"></Option>
               <Option name="hashlimit_value">0</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
@@ -6047,13 +6732,17 @@
           <PolicyRule action="Accept" comment="OUTPUT + FORWARD" direction="Outbound" disabled="False" id="id469FBE8914773" log="False" position="7">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id44F7082928576"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -6067,15 +6756,15 @@
               <Option name="hashlimit_gcinterval">0</Option>
               <Option name="hashlimit_max">0</Option>
               <Option name="hashlimit_mode">dstip</Option>
-              <Option name="hashlimit_name"/>
+              <Option name="hashlimit_name"></Option>
               <Option name="hashlimit_size">0</Option>
-              <Option name="hashlimit_suffix"/>
+              <Option name="hashlimit_suffix"></Option>
               <Option name="hashlimit_value">0</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
@@ -6083,13 +6772,17 @@
           <PolicyRule action="Accept" comment="INPUT + FORWARD" direction="Inbound" disabled="False" id="id469FBE9A14773" log="False" position="8">
             <Src neg="False">
               <ObjectRef ref="id44F7082928576"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -6103,15 +6796,15 @@
               <Option name="hashlimit_gcinterval">0</Option>
               <Option name="hashlimit_max">0</Option>
               <Option name="hashlimit_mode">dstip</Option>
-              <Option name="hashlimit_name"/>
+              <Option name="hashlimit_name"></Option>
               <Option name="hashlimit_size">0</Option>
-              <Option name="hashlimit_suffix"/>
+              <Option name="hashlimit_suffix"></Option>
               <Option name="hashlimit_value">0</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
@@ -6119,13 +6812,17 @@
           <PolicyRule action="Accept" comment="OUTPUT + FORWARD" direction="Both" disabled="False" id="id469F609414773" log="False" position="9">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id44F7082928576"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -6139,15 +6836,15 @@
               <Option name="hashlimit_gcinterval">0</Option>
               <Option name="hashlimit_max">0</Option>
               <Option name="hashlimit_mode">dstip</Option>
-              <Option name="hashlimit_name"/>
+              <Option name="hashlimit_name"></Option>
               <Option name="hashlimit_size">0</Option>
-              <Option name="hashlimit_suffix"/>
+              <Option name="hashlimit_suffix"></Option>
               <Option name="hashlimit_value">0</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
@@ -6155,13 +6852,17 @@
           <PolicyRule action="Accept" comment="INPUT + FORWARD" direction="Both" disabled="False" id="id46A04BD114773" log="False" position="10">
             <Src neg="False">
               <ObjectRef ref="id44F7082928576"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -6175,15 +6876,15 @@
               <Option name="hashlimit_gcinterval">0</Option>
               <Option name="hashlimit_max">0</Option>
               <Option name="hashlimit_mode">dstip</Option>
-              <Option name="hashlimit_name"/>
+              <Option name="hashlimit_name"></Option>
               <Option name="hashlimit_size">0</Option>
-              <Option name="hashlimit_suffix"/>
+              <Option name="hashlimit_suffix"></Option>
               <Option name="hashlimit_value">0</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
@@ -6192,17 +6893,21 @@
             <Src neg="True">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B0C6380"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="icmp-Unreachables"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
@@ -6210,49 +6915,61 @@
             <Src neg="True">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="icmp-Unreachables"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Deny" comment="testing negation in service field" direction="Both" disabled="False" id="id3B0C63BF" log="True" position="13">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="host-hostA"/>
               <ObjectRef ref="host-hostB"/>
-            </Dst><Srv neg="True">
+            </Dst>
+            <Srv neg="True">
               <ServiceRef ref="tcp-SMTP"/>
               <ServiceRef ref="tcp-SSH"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="id3D6864D0"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id45F8C4E113056" log="True" position="14">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="host-hostA"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SMTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="id45F8C4E013056"/>
             </When>
             <PolicyRuleOptions>
@@ -6262,13 +6979,17 @@
           <PolicyRule action="Accept" comment="should permit access to all&#10;addresses that belong to &#10;the firewall, but not to those &#10;that are used in NAT rules &#10;and are added as virtual&#10;addresses" direction="Both" disabled="False" id="id3E4DD6AD" log="False" position="15">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B0C6380"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SMTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -6276,13 +6997,17 @@
           <PolicyRule action="Accept" direction="Both" disabled="True" id="id445880A67646" log="False" position="16">
             <Src neg="False">
               <ObjectRef ref="id3B0C6380"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -6290,29 +7015,37 @@
           <PolicyRule action="Accept" comment="'masquerading' rule" direction="Both" disabled="False" id="id3B0C63CB" log="False" position="17">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id3E20A8E1" log="False" position="18">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="id3B0C6380"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -6320,91 +7053,96 @@
           <PolicyRule action="Deny" comment="'catch all' rule" direction="Both" disabled="False" id="id3B0C63D5" log="True" position="19">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id3B0C6380-routing" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="" dyn="False" id="id3B0C63DF" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.1" id="id3B0C63DF-ipv4" name="address" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="True" id="id3B0C63E1" label="" name="eth1" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="0.0.0.0" id="id3B0C63E1-ipv4" name="address" netmask="0.0.0.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3B0C63F3" name="eth2" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.2.1" id="id3B0C63F3-ipv4" name="address" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3B0C63F5" name="lo" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="127.0.0.1" id="id3B0C63F5-ipv4" name="address" netmask="255.0.0.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3CD88A77" label="" name="eth3" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="222.222.222.222" id="id3CD88A77-ipv4" name="address" netmask="255.255.255.0"/>
+        </Policy>
+        <Routing id="id3B0C6380-routing" name="Routing"/>
+        <Interface bridgeport="False" comment="" dyn="False" id="id3B0C63DF" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id3B0C63DF-ipv4" name="address" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-          <Management address="192.168.1.1">
+        <Interface bridgeport="False" dyn="True" id="id3B0C63E1" label="" name="eth1" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id3B0C63E1-ipv4" name="address" address="0.0.0.0" netmask="0.0.0.0"/>
+        </Interface>
+        <Interface bridgeport="False" dyn="False" id="id3B0C63F3" name="eth2" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id3B0C63F3-ipv4" name="address" address="192.168.2.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" dyn="False" id="id3B0C63F5" name="lo" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id3B0C63F5-ipv4" name="address" address="127.0.0.1" netmask="255.0.0.0"/>
+        </Interface>
+        <Interface bridgeport="False" dyn="False" id="id3CD88A77" label="" name="eth3" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id3CD88A77-ipv4" name="address" address="222.222.222.222" netmask="255.255.255.0"/>
+        </Interface>
+        <Management address="192.168.1.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">False</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="classify_mark_terminating">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="epilog_script"/>
-          <Option name="firewall_dir"/>
+          <Option name="epilog_script"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
-          <Option name="id"/>
+          <Option name="id"></Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">False</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -6414,25 +7152,25 @@
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_ipv6_default_policy">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="platform">iptables</Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"/>
+          <Option name="prolog_script"></Option>
           <Option name="proxy_arp">False</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
-          <Option name="sshArgs"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_cprange">64</Option>
           <Option name="ulog_nlgroup">7</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -6441,7 +7179,7 @@
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="testing firewall_is_part_of_any_and_networks&#10;also testing SNAT and DNAT rules when external interface&#10;has dynamic address&#10;&#10;dynamic interface ppp0 has an address object attached to it&#10;(interface used to be static and had an address, then got&#10;converted to dynamic but address object is still there). Compiler&#10;should ignore this address object and issue a warning.&#10;" host_OS="linux24" id="id3B19BEE6" lastCompiled="1204560061" lastInstalled="1142003872" lastModified="1204560033" name="firewall5" platform="iptables" ro="False">
         <NAT id="id3B19BEE7" name="NAT">
           <NATRule disabled="False" id="id3CFD9EE2" position="0">
@@ -6464,7 +7202,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3E8F5A17" position="1">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3E8F5A17" position="1">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -6484,7 +7223,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id47CC86147550" position="2">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id47CC86147550" position="2">
             <OSrc neg="False">
               <ObjectRef ref="id47CD183A7550"/>
             </OSrc>
@@ -6504,7 +7244,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3CF5B9DB" position="3">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3CF5B9DB" position="3">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -6524,19 +7265,24 @@
               <ServiceRef ref="tcp-SSH"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule></NAT>
-          <Policy id="id3B19BF04" name="Policy">
+          </NATRule>
+        </NAT>
+        <Policy id="id3B19BF04" name="Policy">
           <PolicyRule action="Deny" direction="Inbound" disabled="False" id="id3E4A05B9" log="True" position="0">
             <Src neg="True">
               <ObjectRef ref="id3B19BF3A"/>
               <ObjectRef ref="id3CEBFDFC"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3B19BF3A"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -6547,13 +7293,17 @@
             <Src neg="True">
               <ObjectRef ref="id3B19BF3A"/>
               <ObjectRef ref="id3CEBFDFC"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3E8F5B6F"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -6563,29 +7313,37 @@
           <PolicyRule action="Accept" comment="hostF has the same IP address as firewal." direction="Both" disabled="False" id="id3E4A0446" log="True" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3AFC191C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="icmp-ping_request"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id3E4A0454" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B19BEE6"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -6593,13 +7351,17 @@
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id3E4A0473" log="False" position="4">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B19BF3A"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -6607,13 +7369,17 @@
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id3E4A054C" log="False" position="5">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B19BF58"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -6621,14 +7387,18 @@
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id3E986FF8" log="False" position="6">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3AFC191C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
               <ServiceRef ref="tcp-Telnet"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -6636,14 +7406,18 @@
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id3E987157" log="False" position="7">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id47CD183A7550"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
               <ServiceRef ref="tcp-Telnet"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -6651,14 +7425,18 @@
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id3E9871F4" log="True" position="8">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id47CD183A7550"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
               <ServiceRef ref="tcp-Telnet"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -6666,13 +7444,17 @@
           <PolicyRule action="Accept" comment="firewall is part of Any, so compiler should&#10;generate code in both FORWARD and&#10;OUTPUT chains" direction="Both" disabled="False" id="id3B19C71F" log="False" position="9">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B19C5EB"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -6680,13 +7462,17 @@
           <PolicyRule action="Accept" comment="firewall is part of Any, compiler should&#10;generate code for both FORWARD and&#10;INPUT chains" direction="Both" disabled="False" id="id3B19C72A" log="False" position="10">
             <Src neg="False">
               <ObjectRef ref="id3B19C5EB"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -6694,13 +7480,17 @@
           <PolicyRule action="Accept" comment="because firewall has interface on network&#10;internal_net, compiler should generate code&#10;for both FORWARD and INPUT chains" direction="Both" disabled="False" id="id3E20A4AB" log="False" position="11">
             <Src neg="False">
               <ObjectRef ref="host-hostA"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -6709,13 +7499,17 @@
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B19C5EB"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -6723,101 +7517,105 @@
           <PolicyRule action="Deny" comment="Automatically generated 'catch all' rule" direction="Both" disabled="False" id="id3B19BF30" log="True" position="13">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="id"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="id"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id3B19BEE6-routing" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="" dyn="True" id="id3B19BF3A" label="" mgmt="False" name="ppp0" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.1" comment="" id="id3EF959F7" name="firewall5:ppp0(ip)" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id3B19BF58" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.1" id="id3B19BF58-ipv4" name="address" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3B19C51D" name="eth2" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="192.168.2.1" id="id3B19C51D-ipv4" name="address" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="True" id="id3E8F5B6F" label="" mgmt="False" name="ppp1" security_level="0" unnum="False" unprotected="False"/>
-          <Management address="192.168.1.1">
+        </Policy>
+        <Routing id="id3B19BEE6-routing" name="Routing"/>
+        <Interface bridgeport="False" comment="" dyn="True" id="id3B19BF3A" label="" mgmt="False" name="ppp0" security_level="0" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id3EF959F7" name="firewall5:ppp0(ip)" address="192.168.1.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" comment="" dyn="False" id="id3B19BF58" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id3B19BF58-ipv4" name="address" address="192.168.1.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" dyn="False" id="id3B19C51D" name="eth2" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id3B19C51D-ipv4" name="address" address="192.168.2.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" comment="" dyn="True" id="id3E8F5B6F" label="" mgmt="False" name="ppp1" security_level="0" unnum="False" unprotected="False"/>
+        <Management address="192.168.1.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">False</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP host prohibited</Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">False</Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
-          <Option name="id"/>
+          <Option name="id"></Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="install_script"/>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">False</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
           <Option name="log_all_dropped">False</Option>
           <Option name="log_ip_opt">False</Option>
-          <Option name="log_level"/>
-          <Option name="log_limit_suffix"/>
+          <Option name="log_level"></Option>
+          <Option name="log_limit_suffix"></Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">False</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
           <Option name="platform">iptables</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -6825,21 +7623,24 @@
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="firewall protects host it is running on" host_OS="linux24" id="id3AF5A2BA" lastCompiled="1188097239" lastInstalled="1142003872" lastModified="0" name="host" platform="iptables" ro="False" version="">
-        <NAT id="id3AF5A2BD" name="NAT">
-          </NAT>
-          <Policy id="id3AF5A2BC" name="Policy">
+        <NAT id="id3AF5A2BD" name="NAT"/>
+        <Policy id="id3AF5A2BC" name="Policy">
           <PolicyRule action="Deny" direction="Inbound" disabled="False" id="id3BD8ECD0" log="True" position="0">
             <Src neg="False">
               <ObjectRef ref="id3AF5A2BA"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3AF5A2CB"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -6849,13 +7650,17 @@
           <PolicyRule action="Accept" comment="allow everything on loopback" direction="Inbound" disabled="False" id="id3AFB70C7" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3AF5A2BA"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3AFB7090"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -6863,13 +7668,17 @@
           <PolicyRule action="Accept" comment="allow everything on loopback" direction="Outbound" disabled="False" id="id3AFB70CF" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="id3AF5A2BA"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3AFB7090"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -6877,13 +7686,17 @@
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id3BD8ECC6" log="True" position="3">
             <Src neg="False">
               <ObjectRef ref="id3AF5A2BA"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3AF5A2BA"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3AFB7090"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -6891,13 +7704,17 @@
           <PolicyRule action="Deny" comment="block fragments" direction="Both" disabled="True" id="id3AF5A74B" log="True" position="4">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3AF5A2BA"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="ip-IP_Fragments"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -6907,18 +7724,22 @@
           <PolicyRule action="Accept" direction="Both" disabled="True" id="id3AF5A73A" log="False" position="5">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3AF5A2BA"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SMTP"/>
               <ServiceRef ref="tcp-HTTP"/>
               <ServiceRef ref="tcp-SSH"/>
               <ServiceRef ref="tcp-FTP"/>
               <ServiceRef ref="tcp-Telnet"/>
               <ServiceRef ref="icmp-Unreachables"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -6926,13 +7747,17 @@
           <PolicyRule action="Accept" comment="allow all outgoing connections" direction="Both" disabled="True" id="id3AF5A757" log="False" position="6">
             <Src neg="False">
               <ObjectRef ref="id3AF5A2BA"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -6940,13 +7765,17 @@
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id3FBDC5E7" log="False" position="7">
             <Src neg="False">
               <ObjectRef ref="id3AF5A2BA"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -6954,102 +7783,104 @@
           <PolicyRule action="Deny" comment="'catch all' rule" direction="Both" disabled="False" id="id3AF5A762" log="True" position="8">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="limit_burst">50</Option>
               <Option name="limit_suffix">/minute</Option>
               <Option name="limit_value">10</Option>
-              <Option name="log_level"/>
+              <Option name="log_level"></Option>
               <Option name="log_prefix">CATCH ALL RULE</Option>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id3AF5A2BA-routing" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" dyn="False" id="id3AF5A2CB" name="eth0" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="22.22.22.22" id="id3AF5A2CB-ipv4" name="address" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3AFB7090" name="lo" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="127.0.0.1" id="id3AFB7090-ipv4" name="address" netmask="255.0.0.0"/>
+        </Policy>
+        <Routing id="id3AF5A2BA-routing" name="Routing"/>
+        <Interface bridgeport="False" dyn="False" id="id3AF5A2CB" name="eth0" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id3AF5A2CB-ipv4" name="address" address="22.22.22.22" netmask="255.255.255.0"/>
         </Interface>
-          <Management address="127.0.0.1">
+        <Interface bridgeport="False" dyn="False" id="id3AFB7090" name="lo" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id3AFB7090-ipv4" name="address" address="127.0.0.1" netmask="255.0.0.0"/>
+        </Interface>
+        <Management address="127.0.0.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP host prohibited</Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">False</Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
           <Option name="linux24_ip_forward">0</Option>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">True</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
           <Option name="log_all_dropped">False</Option>
           <Option name="log_ip_opt">False</Option>
           <Option name="log_level">debug</Option>
-          <Option name="log_limit_suffix"/>
+          <Option name="log_limit_suffix"></Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">False</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
           <Option name="platform">iptables</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -7058,7 +7889,7 @@
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="testing rule with firewall in dst and negation&#10;also testing &quot;Destination NAT Onto the Same Network&quot; per Turorial chapter 3.5&#10;testing a rule with src=dst=firewall6 in the global policy (should use all interfaces including loopback)" host_OS="linux24" id="id3C698F1D" lastCompiled="1188097212" lastInstalled="1142003872" lastModified="1142003913" name="firewall6" platform="iptables" ro="False">
         <NAT id="id3C698F1E" name="NAT">
           <NATRule disabled="False" id="id3D5C25BE" position="0">
@@ -7081,7 +7912,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3D5C25B0" position="1">
+          </NATRule>
+          <NATRule disabled="False" id="id3D5C25B0" position="1">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -7101,7 +7933,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="this is SDNAT rule, it translates&#10;both source and destination&#10;this rule should be equivalent to two rules above" disabled="False" id="id3E7949B6" position="2">
+          </NATRule>
+          <NATRule comment="this is SDNAT rule, it translates&#10;both source and destination&#10;this rule should be equivalent to two rules above" disabled="False" id="id3E7949B6" position="2">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -7121,7 +7954,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3E7951E3" position="3">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3E7951E3" position="3">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -7142,7 +7976,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3E7952DB" position="4">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3E7952DB" position="4">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -7163,7 +7998,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3E795311" position="5">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3E795311" position="5">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -7184,7 +8020,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3E9BC4A7" position="6">
+          </NATRule>
+          <NATRule disabled="False" id="id3E9BC4A7" position="6">
             <OSrc neg="True">
               <ObjectRef ref="id3E9BC536"/>
             </OSrc>
@@ -7204,7 +8041,8 @@
               <ServiceRef ref="id3B4FF09A"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3F9F8382" position="7">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3F9F8382" position="7">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -7224,7 +8062,8 @@
               <ServiceRef ref="id3B4FF09A"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3E79538A" position="8">
+          </NATRule>
+          <NATRule disabled="False" id="id3E79538A" position="8">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -7244,7 +8083,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3E79539A" position="9">
+          </NATRule>
+          <NATRule disabled="False" id="id3E79539A" position="9">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -7264,18 +8104,23 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule></NAT>
-          <Policy id="id3C698F9D" name="Policy">
+          </NATRule>
+        </NAT>
+        <Policy id="id3C698F9D" name="Policy">
           <PolicyRule action="Deny" comment="" direction="Inbound" disabled="False" id="id3C699028" log="True" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="id3C698F1D"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3C69901D"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -7285,13 +8130,17 @@
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id3C698FB2" log="True" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="id3C698F1D"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -7301,13 +8150,17 @@
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id3E9C86DD" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="id3C698F1D"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3C698F1D"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -7315,80 +8168,85 @@
           <PolicyRule action="Accept" direction="Both" disabled="True" id="id3D84F6EA" log="True" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3D84F6D7"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id3C698F1D-routing" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="" dyn="False" id="id3C699013" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.1" id="id3C699013-ipv4" name="address" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3C69901D" name="eth1" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="22.22.22.22" id="id3C69901D-ipv4" name="address" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3C699030" name="eth2" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.2.1" comment="" id="id3C699030-ipv4" name="address" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3C699032" name="lo" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="127.0.0.1" id="id3C699032-ipv4" name="address" netmask="255.0.0.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3C699034" name="eth3" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="22.22.23.23" id="id3C699034-ipv4" name="address" netmask="255.255.255.0"/>
+        </Policy>
+        <Routing id="id3C698F1D-routing" name="Routing"/>
+        <Interface bridgeport="False" comment="" dyn="False" id="id3C699013" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id3C699013-ipv4" name="address" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-          <Management address="192.168.1.1">
+        <Interface bridgeport="False" dyn="False" id="id3C69901D" name="eth1" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id3C69901D-ipv4" name="address" address="22.22.22.22" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" dyn="False" id="id3C699030" name="eth2" security_level="100" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id3C699030-ipv4" name="address" address="192.168.2.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" dyn="False" id="id3C699032" name="lo" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id3C699032-ipv4" name="address" address="127.0.0.1" netmask="255.0.0.0"/>
+        </Interface>
+        <Interface bridgeport="False" dyn="False" id="id3C699034" name="eth3" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id3C699034-ipv4" name="address" address="22.22.23.23" netmask="255.255.255.0"/>
+        </Interface>
+        <Management address="192.168.1.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">True</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">False</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -7405,10 +8263,10 @@
           <Option name="no_optimisation">False</Option>
           <Option name="platform">iptables</Option>
           <Option name="proxy_arp">False</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -7417,7 +8275,7 @@
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="testing rules with broadcasts and multicasts and action-on-reject &quot;TCP reset&quot;&#10;&#10;testing rules used for DHCP relay running on the firewall between interfaces eth0 and eth2" host_OS="linux24" id="id3C69BD4F" lastCompiled="1188097218" lastInstalled="1142003872" lastModified="1171611268" name="firewall7" platform="iptables" ro="False" version="">
         <NAT id="id3C69BD50" name="NAT">
           <NATRule comment="this is incorrect rule which should &#10;be refused by compiler" disabled="True" id="id3D6BE398" position="0">
@@ -7440,18 +8298,23 @@
               <ServiceRef ref="id3B5009F7"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule></NAT>
-          <Policy id="id3C69BD51" name="Policy">
+          </NATRule>
+        </NAT>
+        <Policy id="id3C69BD51" name="Policy">
           <PolicyRule action="Accept" direction="Inbound" disabled="False" id="id3C69BDE1" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B64FFAC"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="udp-bootps"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3C69BD5C"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -7459,13 +8322,17 @@
           <PolicyRule action="Accept" comment="" direction="Inbound" disabled="False" id="id3CFBE282" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3CFBE20C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="udp-bootps"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3C69BD5C"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -7473,13 +8340,17 @@
           <PolicyRule action="Accept" comment="" direction="Inbound" disabled="False" id="id3D84EFA8" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3A84EECE"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="udp-bootps"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3C69BD5C"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -7487,13 +8358,17 @@
           <PolicyRule action="Accept" comment="" direction="Inbound" disabled="False" id="id40236CDD" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="id40236C9A"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3CFBE20C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="udp-bootps"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3C69BD5C"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -7501,13 +8376,17 @@
           <PolicyRule action="Accept" direction="Outbound" disabled="False" id="id40236B7B" log="False" position="4">
             <Src neg="False">
               <ObjectRef ref="id3C69BD5C"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3CFBE20C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="udp-bootpc"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3C69BD5C"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -7515,13 +8394,17 @@
           <PolicyRule action="Accept" comment="" direction="Outbound" disabled="False" id="id40236C30" log="False" position="5">
             <Src neg="False">
               <ObjectRef ref="id3C69BD68"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id40236C4D"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="udp-bootps"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3C69BD68"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -7529,13 +8412,17 @@
           <PolicyRule action="Accept" direction="Inbound" disabled="False" id="id40236C6E" log="False" position="6">
             <Src neg="False">
               <ObjectRef ref="id40236C4D"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3C69BD5C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="udp-bootps"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3C69BD68"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -7543,13 +8430,17 @@
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id3EC69DD5" log="True" position="7">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3EC69DA8"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -7559,13 +8450,17 @@
           <PolicyRule action="Accept" comment="compiler should place rule in INPUT chain because this is broadcast destination" direction="Both" disabled="False" id="id3CFBE24A" log="False" position="8">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3CFBE20C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="udp-bootpc"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -7573,13 +8468,17 @@
           <PolicyRule action="Accept" comment="compiler should place rule in INPUT chain because this is broadcast destination" direction="Both" disabled="False" id="id3C69BF13" log="False" position="9">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B64FFAC"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="udp-bootpc"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -7587,13 +8486,17 @@
           <PolicyRule action="Accept" comment="compiler should place rule in INPUT chain because this is broadcast destination" direction="Both" disabled="False" id="id3F6D183C" log="False" position="10">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3F6D17F4"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="udp-bootpc"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -7601,13 +8504,17 @@
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id3D84EF2B" log="True" position="11">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3A84EECE"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -7615,13 +8522,17 @@
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id3D84EF36" log="True" position="12">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3D84EEC8"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -7629,13 +8540,17 @@
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id418E8918" log="False" position="13">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3D84EEC8"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -7643,13 +8558,17 @@
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id45D61A0A23626" log="False" position="14">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id45D61A0923626"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -7657,82 +8576,87 @@
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id418E48F8" log="False" position="15">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3DC75CEC"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id3C69BD4F-routing" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="" dyn="False" id="id3C69BD5C" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.1" id="id3C69BD5C-ipv4" name="address" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3C69BD5E" name="eth1" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="22.22.22.22" id="id3C69BD5E-ipv4" name="address" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3C69BD68" name="eth2" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.2.1" id="id3C69BD68-ipv4" name="address" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3C69BD6A" name="lo" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="127.0.0.1" id="id3C69BD6A-ipv4" name="address" netmask="255.0.0.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3C69BD6C" name="eth3" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="22.22.23.23" id="id3C69BD6C-ipv4" name="address" netmask="255.255.255.0"/>
+        </Policy>
+        <Routing id="id3C69BD4F-routing" name="Routing"/>
+        <Interface bridgeport="False" comment="" dyn="False" id="id3C69BD5C" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id3C69BD5C-ipv4" name="address" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-          <Management address="192.168.1.1">
+        <Interface bridgeport="False" dyn="False" id="id3C69BD5E" name="eth1" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id3C69BD5E-ipv4" name="address" address="22.22.22.22" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" dyn="False" id="id3C69BD68" name="eth2" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id3C69BD68-ipv4" name="address" address="192.168.2.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" dyn="False" id="id3C69BD6A" name="lo" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id3C69BD6A-ipv4" name="address" address="127.0.0.1" netmask="255.0.0.0"/>
+        </Interface>
+        <Interface bridgeport="False" dyn="False" id="id3C69BD6C" name="eth3" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id3C69BD6C-ipv4" name="address" address="22.22.23.23" netmask="255.255.255.0"/>
+        </Interface>
+        <Management address="192.168.1.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">False</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -7741,7 +8665,7 @@
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
@@ -7749,10 +8673,10 @@
           <Option name="no_optimisation">False</Option>
           <Option name="platform">iptables</Option>
           <Option name="proxy_arp">False</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -7761,37 +8685,35 @@
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="this firewall is used to test a rule in the global policy of object &quot;firewall&quot;&#10;" host_OS="linux24" id="id3D0C1E6E" lastCompiled="1188097225" lastInstalled="1142003872" lastModified="0" name="firewall8" platform="iptables" ro="False">
-        <NAT id="id3D0C1E72" name="NAT">
-          </NAT>
-          <Policy id="id3D0C1E71" name="Policy">
-          </Policy>
-          
-          
-          <Routing id="id3D0C1E6E-routing" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="" dyn="False" id="id3D0C1E77" label="fw8:eth0" mgmt="False" name="eth0" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="33.33.33.33" id="id3D0C1E77-ipv4" name="address" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id3D0C1E7A" label="fw8:eth1" mgmt="False" name="eth1" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="172.16.1.1" id="id3D0C1E7A-ipv4" name="address" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id3D0C1E7D" label="fw8:eth2" mgmt="True" name="eth2" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.100.1" id="id3D0C1E7D-ipv4" name="address" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="True" id="id3EE24D62" label="fw8:ppp0" mgmt="False" name="ppp0" security_level="0" unnum="False" unprotected="False"/>
-          <Management address="192.168.100.1">
+        <NAT id="id3D0C1E72" name="NAT"/>
+        <Policy id="id3D0C1E71" name="Policy"/>
+        <Routing id="id3D0C1E6E-routing" name="Routing"/>
+        <Interface bridgeport="False" comment="" dyn="False" id="id3D0C1E77" label="fw8:eth0" mgmt="False" name="eth0" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id3D0C1E77-ipv4" name="address" address="33.33.33.33" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" comment="" dyn="False" id="id3D0C1E7A" label="fw8:eth1" mgmt="False" name="eth1" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id3D0C1E7A-ipv4" name="address" address="172.16.1.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" comment="" dyn="False" id="id3D0C1E7D" label="fw8:eth2" mgmt="True" name="eth2" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id3D0C1E7D-ipv4" name="address" address="192.168.100.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" comment="" dyn="True" id="id3EE24D62" label="fw8:ppp0" mgmt="False" name="ppp0" security_level="0" unnum="False" unprotected="False"/>
+        <Management address="192.168.100.1">
           <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP host prohibited</Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">True</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
@@ -7799,28 +8721,28 @@
           <Option name="ignore_empty_groups">False</Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">True</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -7832,10 +8754,10 @@
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -7843,199 +8765,234 @@
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="testing rules with  action-on-reject &quot;TCP reset&quot;&#10;" host_OS="linux24" id="id3D4DF34B" lastCompiled="1188097232" lastInstalled="1142003872" lastModified="1142003913" name="firewall9" platform="iptables" ro="False">
-        <NAT id="id3D4DF34C" name="NAT">
-          </NAT>
-          <Policy id="id3D4DF34D" name="Policy">
+        <NAT id="id3D4DF34C" name="NAT"/>
+        <Policy id="id3D4DF34D" name="Policy">
           <PolicyRule action="Reject" comment="" direction="Both" disabled="False" id="id3D4DF362" log="True" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3D4DF34B"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-IRC"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="action_on_reject">TCP RST</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Reject" comment="" direction="Both" disabled="False" id="id3D4DF36C" log="True" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3D4DF34B"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="udp-DNS"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="action_on_reject">TCP RST</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Reject" direction="Both" disabled="False" id="id3D4DF376" log="True" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3D4DF34B"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3B457567"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="action_on_reject">TCP RST</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Reject" comment="" direction="Both" disabled="False" id="id3D4DF380" log="True" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3D4DF34B"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3D4DE626"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="action_on_reject">TCP RST</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Reject" comment="" direction="Both" disabled="False" id="id3D4DF38A" log="False" position="4">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3D4DF34B"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3D4DE626"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="action_on_reject">TCP RST</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Reject" comment="" direction="Both" disabled="False" id="id3D4DF394" log="False" position="5">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="id3D4DF34B"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3D4DE626"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="action_on_reject">TCP RST</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Reject" comment="" direction="Both" disabled="False" id="id3D4DF39E" log="False" position="6">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3D4DF34B"/>
-            </Dst><Srv neg="True">
+            </Dst>
+            <Srv neg="True">
               <ServiceRef ref="id3D4DE626"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="action_on_reject">TCP RST</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Reject" comment="" direction="Both" disabled="False" id="id3D4DF3A8" log="True" position="7">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3D4DF34B"/>
-            </Dst><Srv neg="True">
+            </Dst>
+            <Srv neg="True">
               <ServiceRef ref="id3D4DE626"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="action_on_reject">TCP RST</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Reject" direction="Both" disabled="False" id="id4144FF90" log="False" position="8">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-HTTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="action_on_reject">TCP RST</Option>
               <Option name="firewall_is_part_of_any_and_networks">False</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
@@ -8044,23 +9001,27 @@
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-HTTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="action_on_reject">TCP RST</Option>
               <Option name="firewall_is_part_of_any_and_networks">False</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
@@ -8069,24 +9030,28 @@
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-HTTP"/>
               <ServiceRef ref="icmp-Unreachables"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="action_on_reject">TCP RST</Option>
               <Option name="firewall_is_part_of_any_and_networks">False</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
@@ -8095,87 +9060,90 @@
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="icmp-Unreachables"/>
               <ServiceRef ref="tcp-FTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="action_on_reject">TCP RST</Option>
               <Option name="firewall_is_part_of_any_and_networks">False</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id3D4DF34B-routing" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="" dyn="False" id="id3D4DF3B2" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.1" id="id3D4DF3B2-ipv4" name="address" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3D4DF3C8" name="eth1" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="22.22.22.22" id="id3D4DF3C8-ipv4" name="address" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3D4DF3CC" name="lo" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="127.0.0.1" id="id3D4DF3CC-ipv4" name="address" netmask="255.0.0.0"/>
+        </Policy>
+        <Routing id="id3D4DF34B-routing" name="Routing"/>
+        <Interface bridgeport="False" comment="" dyn="False" id="id3D4DF3B2" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id3D4DF3B2-ipv4" name="address" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-          <Management address="192.168.1.1">
+        <Interface bridgeport="False" dyn="False" id="id3D4DF3C8" name="eth1" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id3D4DF3C8-ipv4" name="address" address="22.22.22.22" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" dyn="False" id="id3D4DF3CC" name="lo" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id3D4DF3CC-ipv4" name="address" address="127.0.0.1" netmask="255.0.0.0"/>
+        </Interface>
+        <Management address="192.168.1.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">False</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -8193,9 +9161,9 @@
           <Option name="platform">iptables</Option>
           <Option name="proxy_arp">False</Option>
           <Option name="script_env_path">/bin:/usr/bin:/sbin:/usr/sbin</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -8204,30 +9172,33 @@
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="testing rules with  action-on-reject &quot;TCP reset&quot;&#10;in this firewall, unlike in firewall9, this option is set globally instead of setting it&#10;in the rule options&#10;&#10;" host_OS="linux24" id="id3D4F0A55" inactive="False" lastCompiled="1188096940" lastInstalled="1142003872" lastModified="1169006607" name="firewall10" platform="iptables" ro="False" version="1.2.9">
-        <NAT id="id3D4F0A56" name="NAT">
-          </NAT>
-          <Policy id="id3D4F0A57" name="Policy">
+        <NAT id="id3D4F0A56" name="NAT"/>
+        <Policy id="id3D4F0A57" name="Policy">
           <PolicyRule action="Reject" comment="" direction="Both" disabled="False" id="id3D4F0A58" log="True" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3D4F0A55"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-IRC"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="action_on_reject">ICMP admin prohibited</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
@@ -8235,209 +9206,236 @@
           <PolicyRule action="Reject" comment="" direction="Both" disabled="False" id="id3D4F0A62" log="True" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3D4F0A55"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="udp-DNS"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Reject" direction="Both" disabled="False" id="id3D4F0A6C" log="True" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3D4F0A55"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3B457567"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Reject" comment="" direction="Both" disabled="False" id="id3D4F0A76" log="True" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3D4F0A55"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3D4DE626"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Reject" comment="" direction="Both" disabled="False" id="id3D4F0A80" log="False" position="4">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3D4F0A55"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3D4DE626"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Reject" comment="" direction="Both" disabled="False" id="id3D4F0A8A" log="False" position="5">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="id3D4F0A55"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3D4DE626"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Reject" comment="" direction="Both" disabled="False" id="id3D4F0A94" log="False" position="6">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3D4F0A55"/>
-            </Dst><Srv neg="True">
+            </Dst>
+            <Srv neg="True">
               <ServiceRef ref="id3D4DE626"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Reject" comment="" direction="Both" disabled="False" id="id3D4F0A9E" log="True" position="7">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3D4F0A55"/>
-            </Dst><Srv neg="True">
+            </Dst>
+            <Srv neg="True">
               <ServiceRef ref="id3D4DE626"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id3D4F0A55-routing" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="" dyn="False" id="id3D4F0AA8" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.1" id="id3D4F0AA8-ipv4" name="address" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3D4F0AAA" name="eth1" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="22.22.22.22" id="id3D4F0AAA-ipv4" name="address" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3D4F0AAC" name="lo" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="127.0.0.1" id="id3D4F0AAC-ipv4" name="address" netmask="255.0.0.0"/>
+        </Policy>
+        <Routing id="id3D4F0A55-routing" name="Routing"/>
+        <Interface bridgeport="False" comment="" dyn="False" id="id3D4F0AA8" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id3D4F0AA8-ipv4" name="address" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-          <Management address="192.168.1.1">
+        <Interface bridgeport="False" dyn="False" id="id3D4F0AAA" name="eth1" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id3D4F0AAA-ipv4" name="address" address="22.22.22.22" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" dyn="False" id="id3D4F0AAC" name="lo" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id3D4F0AAC-ipv4" name="address" address="127.0.0.1" netmask="255.0.0.0"/>
+        </Interface>
+        <Management address="192.168.1.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP host unreachable</Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">False</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -8446,7 +9444,7 @@
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
@@ -8455,9 +9453,9 @@
           <Option name="platform">iptables</Option>
           <Option name="proxy_arp">False</Option>
           <Option name="script_env_path">/bin:/usr/bin:/sbin:/usr/sbin</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -8466,7 +9464,7 @@
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="testing rules with broadcasts and multicasts and action-on-reject 'TCP reset'. &#10;&#10;This is BRIDGING FIREWALL &#10;Firewall is part of any is OFF&#10;&#10;Interfaces eth0 and eth1 are parts of the bridge; Interface eth2 is external interface (doing NAT and routing on this interface) Interface eth3 is connected to protected network and is used to manage firewall. This is rather realistic configuration for the bridging firewall " host_OS="linux24" id="id3D94D4F8" inactive="False" lastCompiled="1188096947" lastInstalled="1142003872" lastModified="1171611400" name="firewall11" platform="iptables" ro="False" version="">
         <NAT id="id3D94D4F9" name="NAT">
           <NATRule disabled="True" id="id3E854D22" position="0">
@@ -8489,7 +9487,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3E854D14" position="1">
+          </NATRule>
+          <NATRule disabled="False" id="id3E854D14" position="1">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -8509,18 +9508,23 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule></NAT>
-          <Policy id="id3D94D508" name="Policy">
+          </NATRule>
+        </NAT>
+        <Policy id="id3D94D508" name="Policy">
           <PolicyRule action="Accept" direction="Inbound" disabled="False" id="id3D94D534" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B64FFAC"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3D94D531"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -8528,13 +9532,17 @@
           <PolicyRule action="Accept" comment="" direction="Inbound" disabled="False" id="id3D94D53E" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3CFBE20C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3D94D531"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -8542,13 +9550,17 @@
           <PolicyRule action="Accept" comment="" direction="Inbound" disabled="False" id="id3D94D548" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3A84EECE"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3D94D531"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -8556,13 +9568,17 @@
           <PolicyRule action="Accept" direction="Inbound" disabled="False" id="id3E21FEC7" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3D94D531"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -8570,13 +9586,17 @@
           <PolicyRule action="Accept" comment="" direction="Inbound" disabled="False" id="id3E21FEE5" log="False" position="4">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="net-Internal_net"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3D94D531"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -8584,23 +9604,27 @@
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id41FCD477" log="True" position="5">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3E21FC66"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="firewall_is_part_of_any_and_networks">True</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
@@ -8608,13 +9632,17 @@
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id3D94D509" log="False" position="6">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3CFBE20C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="udp-bootpc"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -8622,14 +9650,18 @@
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id3D94D513" log="False" position="7">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B64FFAC"/>
               <ObjectRef ref="host-hostA"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="udp-bootpc"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -8637,13 +9669,17 @@
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id417B3655" log="False" position="8">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id417B3641"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="udp-bootpc"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -8651,14 +9687,18 @@
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id3D94D51D" log="False" position="9">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3A84EECE"/>
               <ObjectRef ref="host-hostB"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -8666,13 +9706,17 @@
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id3D94D527" log="False" position="10">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3D84EEC8"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -8680,13 +9724,17 @@
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id45D6A3D223626" log="False" position="11">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id45D61A0923626"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -8694,13 +9742,17 @@
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id3E21FE50" log="False" position="12">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="host-hostA"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-IRC"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -8708,13 +9760,17 @@
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id3E21FE32" log="True" position="13">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="host-hostA"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -8724,13 +9780,17 @@
           <PolicyRule action="Accept" comment="this rule should generate commands&#10;in both INPUT and FORWARD chains&#10;because this is a bridging firewall&#10;see bug #811860" direction="Both" disabled="False" id="id3DD4BBC7" log="False" position="14">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3D94D4F8"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -8738,13 +9798,17 @@
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id3F28B8DF" log="False" position="15">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3D94D4F8"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -8752,13 +9816,17 @@
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id3F28B8EA" log="False" position="16">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3F28B886"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -8766,13 +9834,17 @@
           <PolicyRule action="Accept" comment="testing processor checkForUnnumbered" direction="Both" disabled="True" id="id3E854C89" log="False" position="17">
             <Src neg="False">
               <ObjectRef ref="id3D94D552"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -8780,13 +9852,17 @@
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id41FC8F4F" log="True" position="18">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -8796,90 +9872,96 @@
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id41FCB1DE" log="True" position="19">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="firewall_is_part_of_any_and_networks">True</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id3D94D4F8-routing" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="this interface is part of the bridge" dyn="False" id="id3D94D531" label="" mgmt="False" name="eth0" security_level="100" unnum="True" unprotected="False"/><Interface bridgeport="False" comment="" dyn="True" id="id3D94D552" label="" mgmt="False" name="eth2" security_level="0" unnum="False" unprotected="False"/><Interface bridgeport="False" dyn="False" id="id3D94D558" name="lo" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="127.0.0.1" id="id3D94D559" name="address" netmask="255.0.0.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="True" id="id3E21FC66" label="" mgmt="False" name="br0" security_level="100" unnum="False" unprotected="False"/><Interface bridgeport="False" comment="this interface has netmask 255.255.255.255, which is an error&#10;but compiler should handle it properly anyway.&#10;One typical mistake is to put rules that have fw or its interface&#10;in DST into FORWARD chain (shouldbe INPUT chain)&#10;&#10;This is the management interface of the bridging fw. This interface is connected to&#10;the protected subnet. There may be another interface connected to the same&#10;subnet, but that interface would be a bridging interface and have no address.&#10;" dyn="False" id="id3F28B886" label="" mgmt="True" name="eth3" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="10.1.1.1" comment="" id="id3F28B88A" name="firewall11:eth3(ip)" netmask="255.255.255.255"/>
-        </Interface><Interface bridgeport="False" comment="this interface is also a part of the bridge" dyn="False" id="id3F77AFD4" label="" mgmt="False" name="eth1" security_level="100" unnum="True" unprotected="False"/>
-          <Management address="10.1.1.1">
+        </Policy>
+        <Routing id="id3D94D4F8-routing" name="Routing"/>
+        <Interface bridgeport="False" comment="this interface is part of the bridge" dyn="False" id="id3D94D531" label="" mgmt="False" name="eth0" security_level="100" unnum="True" unprotected="False"/>
+        <Interface bridgeport="False" comment="" dyn="True" id="id3D94D552" label="" mgmt="False" name="eth2" security_level="0" unnum="False" unprotected="False"/>
+        <Interface bridgeport="False" dyn="False" id="id3D94D558" name="lo" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id3D94D559" name="address" address="127.0.0.1" netmask="255.0.0.0"/>
+        </Interface>
+        <Interface bridgeport="False" comment="" dyn="True" id="id3E21FC66" label="" mgmt="False" name="br0" security_level="100" unnum="False" unprotected="False"/>
+        <Interface bridgeport="False" comment="this interface has netmask 255.255.255.255, which is an error&#10;but compiler should handle it properly anyway.&#10;One typical mistake is to put rules that have fw or its interface&#10;in DST into FORWARD chain (shouldbe INPUT chain)&#10;&#10;This is the management interface of the bridging fw. This interface is connected to&#10;the protected subnet. There may be another interface connected to the same&#10;subnet, but that interface would be a bridging interface and have no address.&#10;" dyn="False" id="id3F28B886" label="" mgmt="True" name="eth3" security_level="100" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id3F28B88A" name="firewall11:eth3(ip)" address="10.1.1.1" netmask="255.255.255.255"/>
+        </Interface>
+        <Interface bridgeport="False" comment="this interface is also a part of the bridge" dyn="False" id="id3F77AFD4" label="" mgmt="False" name="eth1" security_level="100" unnum="True" unprotected="False"/>
+        <Management address="10.1.1.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">True</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="epilog_script"/>
-          <Option name="firewall_dir"/>
+          <Option name="epilog_script"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">False</Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">False</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -8889,24 +9971,24 @@
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="platform">iptables</Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"/>
+          <Option name="prolog_script"></Option>
           <Option name="proxy_arp">False</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
-          <Option name="sshArgs"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -8916,7 +9998,7 @@
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="This firewall does not do NAT for addresses, but translates port for a server&#10;" host_OS="linux24" id="id3DDDE6C3" lastCompiled="1188096954" lastInstalled="1142003872" lastModified="0" name="firewall12" platform="iptables" ro="False">
         <NAT id="id3DDDE6C7" name="NAT">
           <NATRule disabled="False" id="id3DDDE6D6" position="0">
@@ -8939,7 +10021,8 @@
               <ServiceRef ref="id3DDDE4E4"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3DE472C4" position="1">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3DE472C4" position="1">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -8959,7 +10042,8 @@
               <ServiceRef ref="id3DDDE4E4"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3DE47209" position="2">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3DE47209" position="2">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -8979,7 +10063,8 @@
               <ServiceRef ref="id3DDDE4E4"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3DE3B872" position="3">
+          </NATRule>
+          <NATRule disabled="False" id="id3DE3B872" position="3">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -8999,7 +10084,8 @@
               <ServiceRef ref="id3DDDE4E4"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3DE3B9B2" position="4">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3DE3B9B2" position="4">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -9019,7 +10105,8 @@
               <ServiceRef ref="id3DDDE4E4"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3DE66C32" position="5">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3DE66C32" position="5">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -9039,7 +10126,8 @@
               <ServiceRef ref="id3DDDE4E4"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3ED59A8C" position="6">
+          </NATRule>
+          <NATRule disabled="False" id="id3ED59A8C" position="6">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -9059,7 +10147,8 @@
               <ServiceRef ref="id3DDDE4E4"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3ED59B00" position="7">
+          </NATRule>
+          <NATRule disabled="False" id="id3ED59B00" position="7">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -9079,7 +10168,8 @@
               <ServiceRef ref="id3ED59BF1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3ED59E9D" position="8">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3ED59E9D" position="8">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -9099,7 +10189,8 @@
               <ServiceRef ref="id3ED59BF1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3ED59D48" position="9">
+          </NATRule>
+          <NATRule disabled="False" id="id3ED59D48" position="9">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -9119,18 +10210,23 @@
               <ServiceRef ref="id3DDDE4E4"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule></NAT>
-          <Policy id="id3DDDE6C6" name="Policy">
+          </NATRule>
+        </NAT>
+        <Policy id="id3DDDE6C6" name="Policy">
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id3DDDE701" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3AFADBF9"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3DDDE4E4"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -9138,71 +10234,73 @@
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id3DDDE6F7" log="True" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id3DDDE6C3-routing" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="" dyn="False" id="id3DDDE6CE" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="22.22.22.22" id="id3DDDE6D0" name="firewall12" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id3DDDE6D1" label="" mgmt="False" name="eth1" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="22.22.23.22" id="id3DDDE6D3" name="firewall12" netmask="255.255.255.0"/>
+        </Policy>
+        <Routing id="id3DDDE6C3-routing" name="Routing"/>
+        <Interface bridgeport="False" comment="" dyn="False" id="id3DDDE6CE" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id3DDDE6D0" name="firewall12" address="22.22.22.22" netmask="255.255.255.0"/>
         </Interface>
-          <Management address="22.22.22.22">
+        <Interface bridgeport="False" comment="" dyn="False" id="id3DDDE6D1" label="" mgmt="False" name="eth1" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id3DDDE6D3" name="firewall12" address="22.22.23.22" netmask="255.255.255.0"/>
+        </Interface>
+        <Management address="22.22.22.22">
           <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP host prohibited</Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="limit_suffix"/>
+          <Option name="limit_suffix"></Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">True</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -9214,9 +10312,9 @@
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -9224,7 +10322,7 @@
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="Testing empty groups thing&#10;" host_OS="linux24" id="id3DE68A18" lastCompiled="1188096961" lastInstalled="1142003872" lastModified="0" name="firewall13" platform="iptables" ro="False">
         <NAT id="id3DE68A19" name="NAT">
           <NATRule disabled="False" id="id3DE68AFA" position="0">
@@ -9247,7 +10345,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3DE68B5B" position="1">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3DE68B5B" position="1">
             <OSrc neg="False">
               <ObjectRef ref="id3DE68A00"/>
             </OSrc>
@@ -9267,18 +10366,23 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule></NAT>
-          <Policy id="id3DE68A6E" name="Policy">
+          </NATRule>
+        </NAT>
+        <Policy id="id3DE68A6E" name="Policy">
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id3DE68A6F" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="id3DE68A00"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="host-hostA"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3DDDE4E4"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -9286,13 +10390,17 @@
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id3DE68BA4" log="True" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="host-hostA"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3DE689FF"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -9300,71 +10408,73 @@
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id3DE68A79" log="True" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id3DE68A18-routing" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="" dyn="False" id="id3DE68A83" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="22.22.22.22" id="id3DE68A84" name="firewall12" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id3DE68A86" label="" mgmt="False" name="eth1" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="22.22.23.22" id="id3DE68A87" name="firewall12" netmask="255.255.255.0"/>
+        </Policy>
+        <Routing id="id3DE68A18-routing" name="Routing"/>
+        <Interface bridgeport="False" comment="" dyn="False" id="id3DE68A83" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id3DE68A84" name="firewall12" address="22.22.22.22" netmask="255.255.255.0"/>
         </Interface>
-          <Management address="22.22.22.22">
+        <Interface bridgeport="False" comment="" dyn="False" id="id3DE68A86" label="" mgmt="False" name="eth1" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id3DE68A87" name="firewall12" address="22.22.23.22" netmask="255.255.255.0"/>
+        </Interface>
+        <Management address="22.22.22.22">
           <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP host prohibited</Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">True</Option>
-          <Option name="limit_suffix"/>
+          <Option name="limit_suffix"></Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">True</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -9376,9 +10486,9 @@
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -9386,7 +10496,7 @@
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="special configuration with overlapping subnets on external and dmz interfaces&#10;testing NAT rules (especially choice of interfaces for -o )" host_OS="linux24" id="id3DE71215" lastCompiled="1188096967" lastInstalled="1142003872" lastModified="0" name="firewall14" platform="iptables" ro="False">
         <NAT id="id3DE71216" name="NAT">
           <NATRule disabled="False" id="id3DE71217" position="0">
@@ -9409,7 +10519,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3DE71225" position="1">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3DE71225" position="1">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -9429,7 +10540,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3DE7203A" position="2">
+          </NATRule>
+          <NATRule disabled="False" id="id3DE7203A" position="2">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -9449,7 +10561,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3DE720E6" position="3">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3DE720E6" position="3">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -9469,7 +10582,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="I guess this rule does not make much sense" disabled="False" id="id3DE72150" position="4">
+          </NATRule>
+          <NATRule comment="I guess this rule does not make much sense" disabled="False" id="id3DE72150" position="4">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -9489,7 +10603,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3DE721CA" position="5">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3DE721CA" position="5">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -9509,7 +10624,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3DE7236A" position="6">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3DE7236A" position="6">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -9529,63 +10645,62 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule></NAT>
-          <Policy id="id3DE71233" name="Policy">
-          </Policy>
-          
-          
-          <Routing id="id3DE71215-routing" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="" dyn="False" id="id3DE71252" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.22" comment="" id="id3DE71253" name="fe14:eth0" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id3DE71255" label="eth1(outside)" mgmt="False" name="eth1" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="22.22.23.22" comment="" id="id3DE71256" name="fw14:eth1:1" netmask="255.255.255.0"/>
-          <IPv4 address="22.22.23.160" comment="this address belongs to subnets of both interfaces - eth1 and eth2" id="id3DE71282" name="fw14:eth1:2" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id3DE7127D" label="eth2(dmz)" mgmt="False" name="eth2" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="22.22.23.132" comment="this interface is on the subnet that overlaps with eth1" id="id3DE7127F" name="fw14:eth2" netmask="255.255.255.128"/>
+          </NATRule>
+        </NAT>
+        <Policy id="id3DE71233" name="Policy"/>
+        <Routing id="id3DE71215-routing" name="Routing"/>
+        <Interface bridgeport="False" comment="" dyn="False" id="id3DE71252" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id3DE71253" name="fe14:eth0" address="192.168.1.22" netmask="255.255.255.0"/>
         </Interface>
-          <Management address="192.168.1.22">
+        <Interface bridgeport="False" comment="" dyn="False" id="id3DE71255" label="eth1(outside)" mgmt="False" name="eth1" security_level="0" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id3DE71256" name="fw14:eth1:1" address="22.22.23.22" netmask="255.255.255.0"/>
+          <IPv4 comment="this address belongs to subnets of both interfaces - eth1 and eth2" id="id3DE71282" name="fw14:eth1:2" address="22.22.23.160" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" comment="" dyn="False" id="id3DE7127D" label="eth2(dmz)" mgmt="False" name="eth2" security_level="0" unnum="False" unprotected="False">
+          <IPv4 comment="this interface is on the subnet that overlaps with eth1" id="id3DE7127F" name="fw14:eth2" address="22.22.23.132" netmask="255.255.255.128"/>
+        </Interface>
+        <Management address="192.168.1.22">
           <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP host prohibited</Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">True</Option>
-          <Option name="limit_suffix"/>
+          <Option name="limit_suffix"></Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">True</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -9597,9 +10712,9 @@
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -9607,21 +10722,24 @@
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="Testing &quot;Accept TCP sessions opened prior to firewall restart flag&quot;&#10;in combination with &quot;Assume firewall is part of any&quot; - both&#10;flags are OFF here" host_OS="linux24" id="id3DE9128A" lastCompiled="1188096974" lastInstalled="1142003872" lastModified="0" name="firewall15" platform="iptables" ro="False">
-        <NAT id="id3DE9128B" name="NAT">
-          </NAT>
-          <Policy id="id3DE912E0" name="Policy">
+        <NAT id="id3DE9128B" name="NAT"/>
+        <Policy id="id3DE912E0" name="Policy">
           <PolicyRule action="Accept" comment="option 'assume firewall is part of any'&#10;is off, but this rule should go into &#10;INPUT/OUTPUT chains anyway" direction="Both" disabled="False" id="id3E587D17" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3E587D10"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -9629,73 +10747,76 @@
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id3DE912EB" log="True" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id3DE9128A-routing" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="" dyn="False" id="id3DE912F5" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="22.22.22.22" id="id3DE912F6" name="firewall12" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id3DE912F8" label="" mgmt="False" name="eth1" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="22.22.23.22" id="id3DE912F9" name="firewall12" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id3E587D10" label="" mgmt="False" name="lo" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="127.0.0.1" comment="" id="id3E587D14" name="firewall15:lo(ip)" netmask="255.0.0.0"/>
+        </Policy>
+        <Routing id="id3DE9128A-routing" name="Routing"/>
+        <Interface bridgeport="False" comment="" dyn="False" id="id3DE912F5" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id3DE912F6" name="firewall12" address="22.22.22.22" netmask="255.255.255.0"/>
         </Interface>
-          <Management address="22.22.22.22">
+        <Interface bridgeport="False" comment="" dyn="False" id="id3DE912F8" label="" mgmt="False" name="eth1" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id3DE912F9" name="firewall12" address="22.22.23.22" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" comment="" dyn="False" id="id3E587D10" label="" mgmt="False" name="lo" security_level="0" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id3E587D14" name="firewall15:lo(ip)" address="127.0.0.1" netmask="255.0.0.0"/>
+        </Interface>
+        <Management address="22.22.22.22">
           <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">False</Option>
           <Option name="action_on_reject">ICMP host prohibited</Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="firewall_is_part_of_any_and_networks">False</Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="limit_suffix"/>
+          <Option name="limit_suffix"></Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">True</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -9707,9 +10828,9 @@
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -9717,7 +10838,7 @@
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="testing translation from outside to the web server on DMZ, need to see what happens if clients on internal net connect to the NATted address of this server. This is a kind of &quot;NAT back to the same subnet&quot; with a twist.&#10;&#10;This firewall also has option &quot;local NAT&quot; enabled. NAT rules 0,2-7 should generate code in the OUTPUT and POSTROUTING chains.&#10;" host_OS="linux24" id="id3E189481" lastCompiled="1188096980" lastInstalled="1142003872" lastModified="0" name="firewall16" platform="iptables" ro="False" version="">
         <NAT id="id3E189482" name="NAT">
           <NATRule comment="should generate code in both PREROUTING&#10;and OUTPUT chain because option &quot;local NAT&quot;&#10;is enabled" disabled="False" id="id3E189483" position="0">
@@ -9740,7 +10861,8 @@
               <ServiceRef ref="tcp-HTTP"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3E189491" position="1">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3E189491" position="1">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -9760,7 +10882,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3E6988D3" position="2">
+          </NATRule>
+          <NATRule disabled="False" id="id3E6988D3" position="2">
             <OSrc neg="False">
               <ObjectRef ref="id3E189481"/>
             </OSrc>
@@ -9780,7 +10903,8 @@
               <ServiceRef ref="id3B5009F7"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id418A3247" position="3">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id418A3247" position="3">
             <OSrc neg="False">
               <ObjectRef ref="id3E189481"/>
               <ObjectRef ref="net-Internal_net"/>
@@ -9801,7 +10925,8 @@
               <ServiceRef ref="id3B5009F7"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id4188B45D" position="4">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id4188B45D" position="4">
             <OSrc neg="False">
               <ObjectRef ref="id3E1894ED"/>
             </OSrc>
@@ -9821,7 +10946,8 @@
               <ServiceRef ref="id3B5009F7"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id4188B514" position="5">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id4188B514" position="5">
             <OSrc neg="False">
               <ObjectRef ref="id3E1894EE"/>
             </OSrc>
@@ -9841,7 +10967,8 @@
               <ServiceRef ref="id3B5009F7"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id4188D4D7" position="6">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id4188D4D7" position="6">
             <OSrc neg="False">
               <ObjectRef ref="id3E189481"/>
             </OSrc>
@@ -9861,7 +10988,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id418A524D" position="7">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id418A524D" position="7">
             <OSrc neg="False">
               <ObjectRef ref="id3E189481"/>
               <ObjectRef ref="net-Internal_net"/>
@@ -9882,7 +11010,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id41860063" position="8">
+          </NATRule>
+          <NATRule disabled="False" id="id41860063" position="8">
             <OSrc neg="False">
               <ObjectRef ref="id3E1894ED"/>
             </OSrc>
@@ -9902,7 +11031,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id41873ACE" position="9">
+          </NATRule>
+          <NATRule disabled="False" id="id41873ACE" position="9">
             <OSrc neg="False">
               <ObjectRef ref="id3E1894EE"/>
             </OSrc>
@@ -9922,7 +11052,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id418933C7" position="10">
+          </NATRule>
+          <NATRule disabled="False" id="id418933C7" position="10">
             <OSrc neg="False">
               <ObjectRef ref="id3E189481"/>
             </OSrc>
@@ -9942,7 +11073,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id418A527D" position="11">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id418A527D" position="11">
             <OSrc neg="False">
               <ObjectRef ref="id3E189481"/>
               <ObjectRef ref="net-Internal_net"/>
@@ -9963,7 +11095,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id418933E4" position="12">
+          </NATRule>
+          <NATRule disabled="False" id="id418933E4" position="12">
             <OSrc neg="False">
               <ObjectRef ref="id3E1894ED"/>
             </OSrc>
@@ -9983,7 +11116,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id418933D6" position="13">
+          </NATRule>
+          <NATRule disabled="False" id="id418933D6" position="13">
             <OSrc neg="False">
               <ObjectRef ref="id3E1894EE"/>
             </OSrc>
@@ -10003,18 +11137,23 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule></NAT>
-          <Policy id="id3E1894E5" name="Policy">
+          </NATRule>
+        </NAT>
+        <Policy id="id3E1894E5" name="Policy">
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id3E1896E1" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3D151943"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-HTTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -10022,79 +11161,82 @@
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id3E1896D7" log="True" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id3E189481-routing" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="" dyn="False" id="id3E1894E6" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.22" comment="" id="id3E1894E7" name="firewall16:eth0:ip" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id3E1894E9" label="eth1(outside)" mgmt="False" name="eth1" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="22.22.23.22" comment="" id="id3E1894EA" name="firewall16:eth1:ip" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id3E1894ED" label="eth2(dmz)" mgmt="False" name="eth2" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="192.168.2.1" comment="this interface is on the subnet that overlaps with eth1" id="id3E1894EE" name="firewall16:eth2:ip" netmask="255.255.255.0"/>
+        </Policy>
+        <Routing id="id3E189481-routing" name="Routing"/>
+        <Interface bridgeport="False" comment="" dyn="False" id="id3E1894E6" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id3E1894E7" name="firewall16:eth0:ip" address="192.168.1.22" netmask="255.255.255.0"/>
         </Interface>
-          <Management address="192.168.1.22">
+        <Interface bridgeport="False" comment="" dyn="False" id="id3E1894E9" label="eth1(outside)" mgmt="False" name="eth1" security_level="0" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id3E1894EA" name="firewall16:eth1:ip" address="22.22.23.22" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" comment="" dyn="False" id="id3E1894ED" label="eth2(dmz)" mgmt="False" name="eth2" security_level="0" unnum="False" unprotected="False">
+          <IPv4 comment="this interface is on the subnet that overlaps with eth1" id="id3E1894EE" name="firewall16:eth2:ip" address="192.168.2.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Management address="192.168.1.22">
           <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP host prohibited</Option>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
-          <Option name="epilog_script"/>
-          <Option name="firewall_dir"/>
+          <Option name="epilog_script"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">True</Option>
-          <Option name="limit_suffix"/>
+          <Option name="limit_suffix"></Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">True</Option>
           <Option name="local_nat">True</Option>
           <Option name="log_all">False</Option>
@@ -10106,15 +11248,15 @@
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="prolog_script"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -10123,7 +11265,7 @@
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="doing SNAT with virtual addresses of two external interface&#10;" host_OS="linux24" id="id3E1C6B9C" lastCompiled="1188096987" lastInstalled="1142003872" lastModified="0" name="firewall17" platform="iptables" ro="False">
         <NAT id="id3E1C6B9D" name="NAT">
           <NATRule comment="compiler should add &quot;-o eth2&quot;" disabled="False" id="id3E1C6B9E" position="0">
@@ -10146,7 +11288,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="compiler should add &quot;-o eth2&quot;" disabled="False" id="id3E1C6D1F" position="1">
+          </NATRule>
+          <NATRule comment="compiler should add &quot;-o eth2&quot;" disabled="False" id="id3E1C6D1F" position="1">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -10166,18 +11309,23 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule></NAT>
-          <Policy id="id3E1C6BC8" name="Policy">
+          </NATRule>
+        </NAT>
+        <Policy id="id3E1C6BC8" name="Policy">
           <PolicyRule action="Deny" comment="" direction="Inbound" disabled="False" id="id3E1C6BE3" log="True" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="id3E1C6B9C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3E1C6BE0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -10187,23 +11335,27 @@
           <PolicyRule action="Accounting" direction="Both" disabled="False" id="id3E5F1263" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="firewall_is_part_of_any_and_networks">False</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="rule_name_accounting">rule0acct</Option>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">1</Option>
@@ -10212,23 +11364,27 @@
           <PolicyRule action="Accounting" direction="Both" disabled="False" id="id3E5F126D" log="True" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="firewall_is_part_of_any_and_networks">False</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="rule_name_accounting">rule1acct</Option>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">1</Option>
@@ -10237,24 +11393,28 @@
           <PolicyRule action="Accounting" comment="" direction="Both" disabled="False" id="id41FE52C8" log="True" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="firewall_is_part_of_any_and_networks">False</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
-              <Option name="rule_name_accounting"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
@@ -10262,14 +11422,18 @@
           <PolicyRule action="Accounting" direction="Both" disabled="False" id="id41FA23E1" log="False" position="4">
             <Src neg="False">
               <ObjectRef ref="id3CD87A53"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3D151943"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
               <ServiceRef ref="id3CE719F3"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -10279,13 +11443,17 @@
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id3E1C6BC9" log="True" position="5">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="id3E1C6B9C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -10295,82 +11463,87 @@
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id3E1C6C13" log="False" position="6">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id3E1C6B9C-routing" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="" dyn="False" id="id3E1C6BDD" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.1" id="id3E1C6BDE" name="address" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3E1C6BE0" name="eth1" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="22.22.22.22" id="id3E1C6BE1" name="address" netmask="255.255.255.0"/>
-          <IPv4 address="33.33.33.33" comment="" id="id3E1C6BFB" name="firewall17:eth1(ip)" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3E1C6BEB" name="eth2" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.2.1" comment="" id="id3E1C6BEC" name="address" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3E1C6BEE" name="lo" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="127.0.0.1" id="id3E1C6BEF" name="address" netmask="255.0.0.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3E1C6BF1" name="eth3" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="22.22.23.23" id="id3E1C6BF2" name="address" netmask="255.255.255.0"/>
-          <IPv4 address="44.44.44.44" comment="" id="id3E1C6BFC" name="firewall17:eth3(ip)" netmask="255.255.255.0"/>
+        </Policy>
+        <Routing id="id3E1C6B9C-routing" name="Routing"/>
+        <Interface bridgeport="False" comment="" dyn="False" id="id3E1C6BDD" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id3E1C6BDE" name="address" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-          <Management address="192.168.1.1">
+        <Interface bridgeport="False" dyn="False" id="id3E1C6BE0" name="eth1" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id3E1C6BE1" name="address" address="22.22.22.22" netmask="255.255.255.0"/>
+          <IPv4 comment="" id="id3E1C6BFB" name="firewall17:eth1(ip)" address="33.33.33.33" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" dyn="False" id="id3E1C6BEB" name="eth2" security_level="100" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id3E1C6BEC" name="address" address="192.168.2.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" dyn="False" id="id3E1C6BEE" name="lo" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id3E1C6BEF" name="address" address="127.0.0.1" netmask="255.0.0.0"/>
+        </Interface>
+        <Interface bridgeport="False" dyn="False" id="id3E1C6BF1" name="eth3" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id3E1C6BF2" name="address" address="22.22.23.23" netmask="255.255.255.0"/>
+          <IPv4 comment="" id="id3E1C6BFC" name="firewall17:eth3(ip)" address="44.44.44.44" netmask="255.255.255.0"/>
+        </Interface>
+        <Management address="192.168.1.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">False</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -10387,10 +11560,10 @@
           <Option name="no_optimisation">False</Option>
           <Option name="platform">iptables</Option>
           <Option name="proxy_arp">False</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -10399,7 +11572,7 @@
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="this firewall translates outgoing connections using address of the particular interface (not external one). Also testing different cmbinations of objects in the policy rules on loopback interface. Finally, testing for a situation when dynamic interface &quot;shades&quot; a rule with old broadcast" host_OS="linux24" id="id3EE4CB81" lastCompiled="1188096994" lastInstalled="1142003872" lastModified="1142003885" name="firewall18" platform="iptables" ro="False" version="">
         <NAT id="id3EE4CB85" name="NAT">
           <NATRule disabled="False" id="id3EE4CB98" position="0">
@@ -10422,7 +11595,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3EE4CBC6" position="1">
+          </NATRule>
+          <NATRule disabled="False" id="id3EE4CBC6" position="1">
             <OSrc neg="False">
               <ObjectRef ref="id3EE4CB81"/>
             </OSrc>
@@ -10442,7 +11616,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3EE4CBF2" position="2">
+          </NATRule>
+          <NATRule disabled="False" id="id3EE4CBF2" position="2">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -10462,7 +11637,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3EE4CC1D" position="3">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3EE4CC1D" position="3">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -10482,7 +11658,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3EE4CCB5" position="4">
+          </NATRule>
+          <NATRule disabled="False" id="id3EE4CCB5" position="4">
             <OSrc neg="False">
               <ObjectRef ref="id3EE4CB81"/>
             </OSrc>
@@ -10502,7 +11679,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3EE4CCDF" position="5">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3EE4CCDF" position="5">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -10522,7 +11700,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3EE4CEA6" position="6">
+          </NATRule>
+          <NATRule disabled="False" id="id3EE4CEA6" position="6">
             <OSrc neg="False">
               <ObjectRef ref="id3EE4CB88"/>
             </OSrc>
@@ -10542,18 +11721,23 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule></NAT>
-          <Policy id="id3EE4CB84" name="Policy">
+          </NATRule>
+        </NAT>
+        <Policy id="id3EE4CB84" name="Policy">
           <PolicyRule action="Deny" comment="using address range object&#10;255.255.255.255-255.255.255.255&#10;" direction="Both" disabled="False" id="id3EF40DDB" log="True" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3EF40DD0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3EE4CB8B"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -10563,13 +11747,17 @@
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id3EF7F73E" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3EE4CB91"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -10577,13 +11765,17 @@
           <PolicyRule action="Deny" comment="anti-spoofing rule" direction="Inbound" disabled="False" id="id40D15498" log="True" position="2">
             <Src neg="False">
               <ObjectRef ref="id3EE4CB81"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3EE4CD4C"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -10593,13 +11785,17 @@
           <PolicyRule action="Accept" comment="but old broadcast is permitted" direction="Inbound" disabled="False" id="id40D154A6" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="id40D153ED"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3EE4CB81"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3EE4CD4C"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -10607,79 +11803,84 @@
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id40D153D9" log="True" position="4">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id3EE4CB81-routing" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" dyn="False" id="id3EE4CB88" label="" name="eth2" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="66.66.66.1" comment="" id="id3EE4CB8A" name="firewall18:eth2(ip)" netmask="255.255.255.128"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3EE4CB8B" label="" name="eth0" security_level="33" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.1" id="id3EE4CB8D" name="firewall18:eth0(ip)" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3EE4CB8E" label="" name="eth1" security_level="66" unnum="False" unprotected="False">
-          <IPv4 address="66.66.66.130" comment="" id="id3EE4CB90" name="firewall18:eth1(ip)" netmask="255.255.255.128"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3EE4CB91" label="" name="lo" security_level="99" unnum="False" unprotected="False">
-          <IPv4 address="127.0.0.1" id="id3EE4CB93" name="firewall18:lo(ip)" netmask="255.0.0.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="True" id="id3EE4CD4C" label="" mgmt="False" name="ppp0" security_level="0" unnum="False" unprotected="False"/>
-          <Management address="0.0.0.0">
+        </Policy>
+        <Routing id="id3EE4CB81-routing" name="Routing"/>
+        <Interface bridgeport="False" dyn="False" id="id3EE4CB88" label="" name="eth2" security_level="0" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id3EE4CB8A" name="firewall18:eth2(ip)" address="66.66.66.1" netmask="255.255.255.128"/>
+        </Interface>
+        <Interface bridgeport="False" dyn="False" id="id3EE4CB8B" label="" name="eth0" security_level="33" unnum="False" unprotected="False">
+          <IPv4 id="id3EE4CB8D" name="firewall18:eth0(ip)" address="192.168.1.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" dyn="False" id="id3EE4CB8E" label="" name="eth1" security_level="66" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id3EE4CB90" name="firewall18:eth1(ip)" address="66.66.66.130" netmask="255.255.255.128"/>
+        </Interface>
+        <Interface bridgeport="False" dyn="False" id="id3EE4CB91" label="" name="lo" security_level="99" unnum="False" unprotected="False">
+          <IPv4 id="id3EE4CB93" name="firewall18:lo(ip)" address="127.0.0.1" netmask="255.0.0.0"/>
+        </Interface>
+        <Interface bridgeport="False" comment="" dyn="True" id="id3EE4CD4C" label="" mgmt="False" name="ppp0" security_level="0" unnum="False" unprotected="False"/>
+        <Management address="0.0.0.0">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP host prohibited</Option>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">True</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
-          <Option name="firewall_dir"/>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="limit_suffix"/>
+          <Option name="limit_suffix"></Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
           <Option name="linux24_ip_forward">1</Option>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">True</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -10691,9 +11892,9 @@
           <Option name="log_tcp_seq">False</Option>
           <Option name="loopback_interface">lo</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -10701,21 +11902,24 @@
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">True</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="testing different cmbinations of objects in the policy rules on loopback interface" host_OS="linux24" id="id3EF7F809" lastCompiled="1188097001" lastInstalled="1142003872" lastModified="0" name="firewall19" platform="iptables" ro="False">
-        <NAT id="id3EF7F80A" name="NAT">
-          </NAT>
-          <Policy id="id3EF7F86D" name="Policy">
+        <NAT id="id3EF7F80A" name="NAT"/>
+        <Policy id="id3EF7F86D" name="Policy">
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id3EF7F884" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3EF7F809"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3EF7F881"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -10723,17 +11927,21 @@
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id3EF7F9E2" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3EF7F86E"/>
               <ObjectRef ref="id3EF7F871"/>
               <ObjectRef ref="id3EF7F87E"/>
               <ObjectRef ref="id3EF7F881"/>
               <ObjectRef ref="id3EF7F8B0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3EF7F881"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -10741,13 +11949,17 @@
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id3EF7F89C" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3EF7F871"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3EF7F881"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -10755,13 +11967,17 @@
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id3EF7F8A6" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3EF7F881"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -10769,35 +11985,43 @@
           <PolicyRule action="Accept" disabled="False" id="id3EFB9E41" log="False" position="4">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-TCP-SYN"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="limit_burst">0</Option>
               <Option name="limit_suffix">/second</Option>
               <Option name="limit_value">2</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Deny" comment="" disabled="False" id="id3EFB9E5F" log="True" position="5">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-TCP-SYN"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -10807,35 +12031,43 @@
           <PolicyRule action="Accept" disabled="False" id="id3EFBA6FE" log="False" position="6">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="True">
+            </Dst>
+            <Srv neg="True">
               <ServiceRef ref="tcp-TCP-SYN"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Accept" comment="" disabled="False" id="id40038F90" log="False" position="7">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id40038E79"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -10843,13 +12075,17 @@
           <PolicyRule action="Reject" comment="" disabled="False" id="id40038F1E" log="False" position="8">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id40038E79"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -10859,13 +12095,17 @@
           <PolicyRule action="Reject" disabled="False" id="id40038EB9" log="False" position="9">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="True">
+            </Dst>
+            <Srv neg="True">
               <ServiceRef ref="id40038E79"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -10875,22 +12115,26 @@
           <PolicyRule action="Reject" disabled="False" id="id4003B20A" log="False" position="10">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id4003B1AC"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="action_on_reject">TCP RST</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
@@ -10898,14 +12142,18 @@
           <PolicyRule action="Accept" disabled="False" id="id3F1A2791" log="False" position="11">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3EF7F881"/>
               <ObjectRef ref="id3EF7F87E"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3B4FF09A"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -10913,13 +12161,17 @@
           <PolicyRule action="Deny" disabled="False" id="id3EFB9E6D" log="True" position="12">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -10929,75 +12181,80 @@
           <PolicyRule action="Deny" disabled="True" id="id3F1B9CCE" log="True" position="13">
             <Src neg="False">
               <ObjectRef ref="id3F1B9C18"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id3EF7F809-routing" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" dyn="False" id="id3EF7F86E" label="" name="eth2" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="66.66.66.1" comment="" id="id3EF7F86F" name="firewall18:eth2(ip)" netmask="255.255.255.128"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3EF7F871" label="" name="eth0" security_level="33" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.1" id="id3EF7F872" name="firewall18:eth0(ip)" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3EF7F87E" label="" name="eth1" security_level="66" unnum="False" unprotected="False">
-          <IPv4 address="66.66.66.130" comment="" id="id3EF7F87F" name="firewall18:eth1(ip)" netmask="255.255.255.128"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3EF7F881" label="" name="lo" security_level="99" unnum="False" unprotected="False">
-          <IPv4 address="127.0.0.1" id="id3EF7F882" name="firewall18:lo(ip)" netmask="255.0.0.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="True" id="id3EF7F8B0" label="" mgmt="False" name="ppp0" security_level="0" unnum="False" unprotected="False"/>
-          <Management address="0.0.0.0">
+        </Policy>
+        <Routing id="id3EF7F809-routing" name="Routing"/>
+        <Interface bridgeport="False" dyn="False" id="id3EF7F86E" label="" name="eth2" security_level="0" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id3EF7F86F" name="firewall18:eth2(ip)" address="66.66.66.1" netmask="255.255.255.128"/>
+        </Interface>
+        <Interface bridgeport="False" dyn="False" id="id3EF7F871" label="" name="eth0" security_level="33" unnum="False" unprotected="False">
+          <IPv4 id="id3EF7F872" name="firewall18:eth0(ip)" address="192.168.1.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" dyn="False" id="id3EF7F87E" label="" name="eth1" security_level="66" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id3EF7F87F" name="firewall18:eth1(ip)" address="66.66.66.130" netmask="255.255.255.128"/>
+        </Interface>
+        <Interface bridgeport="False" dyn="False" id="id3EF7F881" label="" name="lo" security_level="99" unnum="False" unprotected="False">
+          <IPv4 id="id3EF7F882" name="firewall18:lo(ip)" address="127.0.0.1" netmask="255.0.0.0"/>
+        </Interface>
+        <Interface bridgeport="False" comment="" dyn="True" id="id3EF7F8B0" label="" mgmt="False" name="ppp0" security_level="0" unnum="False" unprotected="False"/>
+        <Management address="0.0.0.0">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP host prohibited</Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="limit_suffix"/>
+          <Option name="limit_suffix"></Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
           <Option name="linux24_ip_forward">1</Option>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">True</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -11009,9 +12266,9 @@
           <Option name="log_tcp_seq">False</Option>
           <Option name="loopback_interface">lo</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -11019,7 +12276,7 @@
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">True</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="testing firewall_is_part_of_any_and_networks&#10;also testing SNAT and DNAT rules when external interface&#10;has dynamic address&#10;&#10;dynamic interface ppp0 has an address object attached to it&#10;(interface used to be static and had an address, then got&#10;converted to dynamic but address object is still there). Compiler&#10;should ignore this address object and issue a warning.&#10;" host_OS="linux24" id="id3EFBC648" lastCompiled="1188097016" lastInstalled="1142003872" lastModified="1142003913" name="firewall20" platform="iptables" ro="False" version="">
         <NAT id="id3EFBC649" name="NAT">
           <NATRule disabled="False" id="id3EFBC64A" position="0">
@@ -11042,7 +12299,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3EFBC658" position="1">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3EFBC658" position="1">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -11062,7 +12320,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id3EFBC666" position="2">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id3EFBC666" position="2">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -11082,7 +12341,8 @@
               <ServiceRef ref="tcp-SSH"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3FADADE5" position="3">
+          </NATRule>
+          <NATRule disabled="False" id="id3FADADE5" position="3">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -11102,18 +12362,23 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule></NAT>
-          <Policy id="id3EFBC674" name="Policy">
+          </NATRule>
+        </NAT>
+        <Policy id="id3EFBC674" name="Policy">
           <PolicyRule action="Deny" comment="ppp clients get addresses on 10.1.1.0" direction="Inbound" disabled="False" id="id3EFBC6F4" log="True" position="0">
             <Src neg="True">
               <ObjectRef ref="id3EFBCCBA"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3EFBC6F1"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -11123,13 +12388,17 @@
           <PolicyRule action="Deny" comment="ppp clients can not connect to the firewall" direction="Inbound" disabled="False" id="id3EFBCAFF" log="True" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3EFBC6F1"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3EFBC6F1"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -11139,13 +12408,17 @@
           <PolicyRule action="Deny" direction="Inbound" disabled="False" id="id3EFBCBA3" log="True" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3EFBC648"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3EFBC6F1"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -11155,14 +12428,18 @@
           <PolicyRule action="Accept" comment="ppp clients can only connect to the mail&#10;server and web proxy on DMZ" direction="Inbound" disabled="False" id="id3EFBCB1F" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3D151943"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SMTP"/>
               <ServiceRef ref="id3B4FF09A"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3EFBC6F1"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -11170,14 +12447,18 @@
           <PolicyRule action="Deny" comment="ppp clients can not connect to&#10;anything else on DMZ and&#10;internal net" direction="Inbound" disabled="False" id="id3EFBCB6C" log="True" position="4">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B022266"/>
               <ObjectRef ref="net-Internal_net"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3EFBC6F1"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -11187,13 +12468,17 @@
           <PolicyRule action="Accept" direction="Inbound" disabled="False" id="id433C890013970" log="False" position="5">
             <Src neg="True">
               <ObjectRef ref="id3B665643"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3EFBC6F1"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -11201,13 +12486,17 @@
           <PolicyRule action="Deny" comment="" direction="Inbound" disabled="False" id="id3EFBCACB" log="True" position="6">
             <Src neg="True">
               <ObjectRef ref="id3B022266"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3EFBC702"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -11217,29 +12506,37 @@
           <PolicyRule action="Accept" comment="hostF has the same IP address as firewal." direction="Both" disabled="False" id="id3EFBC675" log="True" position="7">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3AFC191C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="icmp-ping_request"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id3EFBC67F" log="False" position="8">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3EFBC648"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -11247,13 +12544,17 @@
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id3EFBC689" log="False" position="9">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3EFBC6F1"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -11261,13 +12562,17 @@
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id3EFBC693" log="False" position="10">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B19BF58"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -11275,14 +12580,18 @@
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id3EFBC69D" log="False" position="11">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3AFC191C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
               <ServiceRef ref="tcp-Telnet"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -11290,14 +12599,18 @@
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id3EFBC6A8" log="False" position="12">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3E9870D1"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
               <ServiceRef ref="tcp-Telnet"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -11305,14 +12618,18 @@
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id3EFBC6B3" log="True" position="13">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3E9870D1"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
               <ServiceRef ref="tcp-Telnet"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -11320,13 +12637,17 @@
           <PolicyRule action="Accept" comment="firewall is part of Any, so compiler should&#10;generate code in both FORWARD and&#10;OUTPUT chains" direction="Both" disabled="False" id="id3EFBC6BE" log="False" position="14">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B19C5EB"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -11334,13 +12655,17 @@
           <PolicyRule action="Accept" comment="firewall is part of Any, compiler should&#10;generate code for both FORWARD and&#10;INPUT chains" direction="Both" disabled="False" id="id3EFBC6C8" log="False" position="15">
             <Src neg="False">
               <ObjectRef ref="id3B19C5EB"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -11348,13 +12673,17 @@
           <PolicyRule action="Accept" comment="because firewall has interface on network&#10;internal_net, compiler should generate code&#10;for both FORWARD and INPUT chains" direction="Both" disabled="False" id="id3EFBC6D2" log="False" position="16">
             <Src neg="False">
               <ObjectRef ref="host-hostA"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -11363,13 +12692,17 @@
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B19C5EB"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -11377,101 +12710,104 @@
           <PolicyRule action="Deny" comment="Automatically generated 'catch all' rule" direction="Both" disabled="False" id="id3EFBC6E7" log="True" position="18">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="id"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="id"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id3EFBC648-routing" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="" dyn="True" id="id3EFBC6F1" label="" mgmt="False" name="ppp*" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.1" comment="" id="id3EFBC6F2" name="firewall5:ppp0(ip)" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id3EFBC6FF" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.1" id="id3EFBC700" name="address" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id3EFBC702" name="eth2" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="192.168.2.1" id="id3EFBC703" name="address" netmask="255.255.255.0"/>
+        </Policy>
+        <Routing id="id3EFBC648-routing" name="Routing"/>
+        <Interface bridgeport="False" comment="" dyn="True" id="id3EFBC6F1" label="" mgmt="False" name="ppp*" security_level="0" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id3EFBC6F2" name="firewall5:ppp0(ip)" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-          <Management address="192.168.1.1">
+        <Interface bridgeport="False" comment="" dyn="False" id="id3EFBC6FF" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id3EFBC700" name="address" address="192.168.1.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" dyn="False" id="id3EFBC702" name="eth2" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id3EFBC703" name="address" address="192.168.2.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Management address="192.168.1.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">False</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP host prohibited</Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
-          <Option name="id"/>
+          <Option name="id"></Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="install_script"/>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">False</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
           <Option name="log_all_dropped">False</Option>
           <Option name="log_ip_opt">False</Option>
-          <Option name="log_level"/>
-          <Option name="log_limit_suffix"/>
+          <Option name="log_level"></Option>
+          <Option name="log_limit_suffix"></Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
           <Option name="platform">iptables</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -11479,7 +12815,7 @@
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">True</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="two dynamic interfaces in the same policy or NAT rule&#10;" host_OS="linux24" id="id3F29FAAD" lastCompiled="1188097023" lastInstalled="1142003872" lastModified="0" name="firewall21" platform="iptables" ro="False">
         <NAT id="id3F29FAAE" name="NAT">
           <NATRule disabled="False" id="id3F2A008C" position="0">
@@ -11503,18 +12839,23 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule></NAT>
-          <Policy id="id3F29FACB" name="Policy">
+          </NATRule>
+        </NAT>
+        <Policy id="id3F29FACB" name="Policy">
           <PolicyRule action="Accept" direction="Outbound" disabled="False" id="id414F492F" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="id3F29FAF4"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3F29FAF4"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -11524,13 +12865,17 @@
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3F29FAF4"/>
               <ObjectRef ref="id3F29FAF7"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -11538,14 +12883,18 @@
           <PolicyRule action="Accept" disabled="False" id="id3FFA5833" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3F6D17F4"/>
               <ObjectRef ref="id3F29FAF4"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sg-DHCP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -11553,76 +12902,80 @@
           <PolicyRule action="Deny" disabled="False" id="id3F29FAE0" log="True" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id3F29FAAD-routing" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="" dyn="True" id="id3F29FAF4" label="" mgmt="False" name="eth0" security_level="0" unnum="False" unprotected="False"/><Interface bridgeport="False" comment="" dyn="True" id="id3F29FAF7" label="" mgmt="False" name="eth1" security_level="0" unnum="False" unprotected="False"/><Interface bridgeport="False" dyn="False" id="id3F29FB06" name="lo" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="127.0.0.1" id="id3F29FB07" name="address" netmask="255.0.0.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id3F29FB90" label="" mgmt="True" name="eth2" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.100" comment="" id="id3F29FB92" name="firewall21:eth2(ip)" netmask="255.255.255.0"/>
+        </Policy>
+        <Routing id="id3F29FAAD-routing" name="Routing"/>
+        <Interface bridgeport="False" comment="" dyn="True" id="id3F29FAF4" label="" mgmt="False" name="eth0" security_level="0" unnum="False" unprotected="False"/>
+        <Interface bridgeport="False" comment="" dyn="True" id="id3F29FAF7" label="" mgmt="False" name="eth1" security_level="0" unnum="False" unprotected="False"/>
+        <Interface bridgeport="False" dyn="False" id="id3F29FB06" name="lo" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id3F29FB07" name="address" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
-          <Management address="192.168.1.100">
+        <Interface bridgeport="False" comment="" dyn="False" id="id3F29FB90" label="" mgmt="True" name="eth2" security_level="100" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id3F29FB92" name="firewall21:eth2(ip)" address="192.168.1.100" netmask="255.255.255.0"/>
+        </Interface>
+        <Management address="192.168.1.100">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">False</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -11639,10 +12992,10 @@
           <Option name="no_optimisation">False</Option>
           <Option name="platform">iptables</Option>
           <Option name="proxy_arp">False</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -11651,7 +13004,7 @@
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="testing NAT rules using custom services&#10;" host_OS="linux24" id="id3FADB89A" lastCompiled="1188097029" lastInstalled="1142003872" lastModified="1142003913" name="firewall22" platform="iptables" ro="False" version="1.2.9">
         <NAT id="id3FADB89B" name="NAT">
           <NATRule disabled="False" id="id3FADBAA3" position="0">
@@ -11674,7 +13027,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3FADBAC2" position="1">
+          </NATRule>
+          <NATRule disabled="False" id="id3FADBAC2" position="1">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -11694,7 +13048,8 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id3FADBAD4" position="2">
+          </NATRule>
+          <NATRule disabled="False" id="id3FADBAD4" position="2">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -11714,18 +13069,23 @@
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule></NAT>
-          <Policy id="id3FADB8D4" name="Policy">
+          </NATRule>
+        </NAT>
+        <Policy id="id3FADB8D4" name="Policy">
           <PolicyRule action="Deny" comment="" direction="Inbound" disabled="False" id="id3FADB98E" log="True" position="0">
             <Src neg="True">
               <ObjectRef ref="id3B022266"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3FADB98B"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -11735,102 +13095,104 @@
           <PolicyRule action="Deny" comment="" disabled="False" id="id3FADB947" log="True" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="id"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="id"></Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
               <Option name="log_level">error</Option>
-              <Option name="log_prefix"/>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
               <Option name="ulog_nlgroup">10</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id3FADB89A-routing" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="" dyn="False" id="id3FADB988" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.1" id="id3FADB989" name="address" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id3FADB98B" label="" mgmt="False" name="eth1" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="192.168.2.1" id="id3FADB98C" name="address" netmask="255.255.255.0"/>
+        </Policy>
+        <Routing id="id3FADB89A-routing" name="Routing"/>
+        <Interface bridgeport="False" comment="" dyn="False" id="id3FADB988" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id3FADB989" name="address" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-          <Management address="192.168.1.1">
+        <Interface bridgeport="False" comment="" dyn="False" id="id3FADB98B" label="" mgmt="False" name="eth1" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id3FADB98C" name="address" address="192.168.2.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Management address="192.168.1.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">False</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP host prohibited</Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
-          <Option name="id"/>
+          <Option name="id"></Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="install_script"/>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">False</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
           <Option name="log_all_dropped">False</Option>
           <Option name="log_ip_opt">False</Option>
-          <Option name="log_level"/>
-          <Option name="log_limit_suffix"/>
+          <Option name="log_level"></Option>
+          <Option name="log_limit_suffix"></Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
           <Option name="platform">iptables</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -11838,21 +13200,24 @@
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">True</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="&#10;This is BRIDGING FIREWALL&#10;&#10;" host_OS="linux24" id="id3FB32E8E" lastCompiled="1188097036" lastInstalled="1142003872" lastModified="1142003859" name="firewall23" platform="iptables" ro="False">
-        <NAT id="id3FB32E8F" name="NAT">
-          </NAT>
-          <Policy id="id3FB32EAC" name="Policy">
+        <NAT id="id3FB32E8F" name="NAT"/>
+        <Policy id="id3FB32EAC" name="Policy">
           <PolicyRule action="Accept" direction="Inbound" disabled="False" id="id3FB33184" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3FB32E8E"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3FB32F13"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -11860,13 +13225,17 @@
           <PolicyRule action="Accept" comment="" direction="Inbound" disabled="False" id="id402A6DCC" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3FB32F13"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -11874,13 +13243,17 @@
           <PolicyRule action="Accept" direction="Inbound" disabled="False" id="id3FB32F15" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B64FFAC"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3FB32F13"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -11888,13 +13261,17 @@
           <PolicyRule action="Accept" comment="" direction="Inbound" disabled="False" id="id3FB32F1F" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3CFBE20C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3FB32F13"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -11902,13 +13279,17 @@
           <PolicyRule action="Accept" comment="" direction="Inbound" disabled="False" id="id3FB32F29" log="False" position="4">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3A84EECE"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3FB32F13"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -11916,13 +13297,17 @@
           <PolicyRule action="Accept" direction="Inbound" disabled="False" id="id3FB32F33" log="False" position="5">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3FB32F13"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -11930,13 +13315,17 @@
           <PolicyRule action="Accept" comment="" direction="Inbound" disabled="False" id="id3FB32F3D" log="False" position="6">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="net-Internal_net"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id3FB32F13"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -11944,13 +13333,17 @@
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id3FB32EAD" log="False" position="7">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3CFBE20C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="udp-bootpc"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -11958,14 +13351,18 @@
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id3FB32EB7" log="False" position="8">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B64FFAC"/>
               <ObjectRef ref="host-hostA"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="udp-bootpc"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -11973,14 +13370,18 @@
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id3FB32EC2" log="False" position="9">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3A84EECE"/>
               <ObjectRef ref="host-hostB"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -11988,13 +13389,17 @@
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id3FB32ECD" log="False" position="10">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3D84EEC8"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -12002,13 +13407,17 @@
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id3FB32ED7" log="False" position="11">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="host-hostA"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-IRC"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -12016,13 +13425,17 @@
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id3FB32EE1" log="True" position="12">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="host-hostA"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -12032,13 +13445,17 @@
           <PolicyRule action="Accept" comment="this rule should generate commands&#10;in both INPUT and FORWARD chains&#10;because this is a bridging firewall&#10;see bug #811860" direction="Both" disabled="False" id="id3FB32EEB" log="False" position="13">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3FB32E8E"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -12046,13 +13463,17 @@
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id3FB32EF5" log="False" position="14">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3FB32E8E"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -12060,13 +13481,17 @@
           <PolicyRule action="Accept" comment="interface of another firewall&#10;(firewall11)&#10;Why do we need to test for this?&#10;" direction="Both" disabled="False" id="id3FB32EFF" log="False" position="15">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3F28B886"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -12074,74 +13499,77 @@
           <PolicyRule action="Accept" comment="testing processor checkForUnnumbered" direction="Both" disabled="True" id="id3FB32F09" log="False" position="16">
             <Src neg="False">
               <ObjectRef ref="id3FB32F13"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id3FB32E8E-routing" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="this interface is part of the bridge" dyn="False" id="id3FB32F13" label="" mgmt="False" name="eth*" security_level="100" unnum="True" unprotected="False"/><Interface bridgeport="False" dyn="False" id="id3FB32F49" name="lo" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="127.0.0.1" id="id3FB32F4A" name="address" netmask="255.0.0.0"/>
-        </Interface><Interface bridgeport="False" comment="c" dyn="False" id="id3FB32F4C" label="" mgmt="False" name="br0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.1" comment="" id="id3FB331CD" name="firewall23:br0(ip)" netmask="255.255.255.0"/>
+        </Policy>
+        <Routing id="id3FB32E8E-routing" name="Routing"/>
+        <Interface bridgeport="False" comment="this interface is part of the bridge" dyn="False" id="id3FB32F13" label="" mgmt="False" name="eth*" security_level="100" unnum="True" unprotected="False"/>
+        <Interface bridgeport="False" dyn="False" id="id3FB32F49" name="lo" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id3FB32F4A" name="address" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
-          <Management address="192.168.1.1">
+        <Interface bridgeport="False" comment="c" dyn="False" id="id3FB32F4C" label="" mgmt="False" name="br0" security_level="100" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id3FB331CD" name="firewall23:br0(ip)" address="192.168.1.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Management address="192.168.1.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
           <Option name="bridging_fw">True</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">False</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -12150,7 +13578,7 @@
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
@@ -12158,10 +13586,10 @@
           <Option name="no_optimisation">False</Option>
           <Option name="platform">iptables</Option>
           <Option name="proxy_arp">False</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -12170,21 +13598,24 @@
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="testing rules on unnumbered interface tun*&#10;" host_OS="linux24" id="id402B23A8" lastCompiled="1188097050" lastInstalled="1142003872" lastModified="0" name="firewall24" platform="iptables" ro="False">
-        <NAT id="id402B23A9" name="NAT">
-          </NAT>
-          <Policy id="id402B23AA" name="Policy">
+        <NAT id="id402B23A9" name="NAT"/>
+        <Policy id="id402B23AA" name="Policy">
           <PolicyRule action="Accept" direction="Inbound" disabled="False" id="id402B2413" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id402B23A8"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id402B2411"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -12192,13 +13623,17 @@
           <PolicyRule action="Accept" comment="" direction="Inbound" disabled="False" id="id402B241D" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id402B2411"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -12206,13 +13641,17 @@
           <PolicyRule action="Accept" comment="" direction="Outbound" disabled="False" id="id402B268E" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id402B2411"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -12220,13 +13659,17 @@
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id402B269C" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id402B2411"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -12234,13 +13677,17 @@
           <PolicyRule action="Accept" comment="" direction="Inbound" disabled="False" id="id403B9475" log="False" position="4">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sg-DHCP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id402B2411"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -12248,13 +13695,17 @@
           <PolicyRule action="Accept" direction="Inbound" disabled="False" id="id402B2427" log="False" position="5">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B64FFAC"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id402B2411"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -12262,13 +13713,17 @@
           <PolicyRule action="Accept" comment="" direction="Inbound" disabled="False" id="id402B2431" log="False" position="6">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3CFBE20C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id402B2411"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -12276,13 +13731,17 @@
           <PolicyRule action="Accept" comment="" direction="Inbound" disabled="False" id="id402B243B" log="False" position="7">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3A84EECE"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id402B2411"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -12290,13 +13749,17 @@
           <PolicyRule action="Accept" direction="Inbound" disabled="False" id="id402B2445" log="False" position="8">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id402B2411"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -12304,13 +13767,17 @@
           <PolicyRule action="Accept" comment="" direction="Inbound" disabled="False" id="id402B244F" log="False" position="9">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="net-Internal_net"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id402B2411"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -12318,13 +13785,17 @@
           <PolicyRule action="Accept" comment="" disabled="False" id="id402B23AB" log="False" position="10">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3CFBE20C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="udp-bootpc"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -12332,14 +13803,18 @@
           <PolicyRule action="Accept" comment="" disabled="False" id="id402B23B5" log="False" position="11">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B64FFAC"/>
               <ObjectRef ref="host-hostA"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="udp-bootpc"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -12347,13 +13822,17 @@
           <PolicyRule action="Accept" comment="" disabled="False" id="id417C304A" log="False" position="12">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id417B3641"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="udp-bootpc"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -12361,14 +13840,18 @@
           <PolicyRule action="Accept" disabled="False" id="id402B23C0" log="False" position="13">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3A84EECE"/>
               <ObjectRef ref="host-hostB"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -12376,13 +13859,17 @@
           <PolicyRule action="Accept" disabled="False" id="id402B23CB" log="False" position="14">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3D84EEC8"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -12390,13 +13877,17 @@
           <PolicyRule action="Accept" comment="" disabled="False" id="id402B23D5" log="False" position="15">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="host-hostA"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-IRC"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -12404,13 +13895,17 @@
           <PolicyRule action="Deny" disabled="False" id="id402B23DF" log="True" position="16">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="host-hostA"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -12420,13 +13915,17 @@
           <PolicyRule action="Accept" disabled="False" id="id402B23E9" log="False" position="17">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id402B23A8"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -12434,13 +13933,17 @@
           <PolicyRule action="Accept" disabled="False" id="id402B23F3" log="False" position="18">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id402B23A8"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -12448,13 +13951,17 @@
           <PolicyRule action="Accept" disabled="False" id="id402B23FD" log="False" position="19">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id402B245C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -12462,74 +13969,77 @@
           <PolicyRule action="Accept" comment="testing processor checkForUnnumbered" disabled="True" id="id402B2407" log="False" position="20">
             <Src neg="False">
               <ObjectRef ref="id402B2411"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id402B23A8-routing" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="this interface is part of the bridge" dyn="False" id="id402B2411" label="" mgmt="False" name="tun*" security_level="100" unnum="True" unprotected="False"/><Interface bridgeport="False" dyn="False" id="id402B2459" name="lo" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="127.0.0.1" id="id402B245A" name="address" netmask="255.0.0.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id402B245C" label="" mgmt="False" name="eth0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.1" comment="" id="id402B245D" name="firewall23:eth0(ip)" netmask="255.255.255.0"/>
+        </Policy>
+        <Routing id="id402B23A8-routing" name="Routing"/>
+        <Interface bridgeport="False" comment="this interface is part of the bridge" dyn="False" id="id402B2411" label="" mgmt="False" name="tun*" security_level="100" unnum="True" unprotected="False"/>
+        <Interface bridgeport="False" dyn="False" id="id402B2459" name="lo" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id402B245A" name="address" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
-          <Management address="192.168.1.1">
+        <Interface bridgeport="False" comment="" dyn="False" id="id402B245C" label="" mgmt="False" name="eth0" security_level="100" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id402B245D" name="firewall23:eth0(ip)" address="192.168.1.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Management address="192.168.1.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">False</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -12538,7 +14048,7 @@
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
@@ -12546,10 +14056,10 @@
           <Option name="no_optimisation">False</Option>
           <Option name="platform">iptables</Option>
           <Option name="proxy_arp">False</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -12558,21 +14068,24 @@
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="This is an example of a firewall protecting a host ( a server or a workstation). Only SSH access to the host is permitted. Host has dynamic address." host_OS="linux24" id="id41528C2C" lastCompiled="1188097246" lastInstalled="1142003872" lastModified="0" name="rh90" platform="iptables" ro="False" version="">
-        <NAT id="id41528C52" name="NAT">
-          </NAT>
-          <Policy id="id41528C31" name="Policy">
+        <NAT id="id41528C52" name="NAT"/>
+        <Policy id="id41528C31" name="Policy">
           <PolicyRule action="Deny" comment="anti spoofing rule" direction="Inbound" disabled="False" id="id41528C60" log="True" position="0">
             <Src neg="False">
               <ObjectRef ref="id41528C2C"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id41528C53"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -12582,13 +14095,17 @@
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id41528C78" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id41528C6A"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -12596,15 +14113,19 @@
           <PolicyRule action="Accept" comment="SSH Access to the host; useful ICMP&#10;types; ping request" direction="Both" disabled="False" id="id41528C32" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id41528C2C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
               <ServiceRef ref="sg-Useful_ICMP"/>
               <ServiceRef ref="icmp-ping_request"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -12612,13 +14133,17 @@
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id41528C3E" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="id41528C2C"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -12626,35 +14151,37 @@
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id41528C48" log="True" position="4">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id41528C2C-routing" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="" dyn="False" id="id41528C53" label="outside" mgmt="True" name="eth0" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="10.3.14.58" comment="" id="id41528C88" name="rh90:eth0:ip" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id41528C6A" label="loopback" mgmt="False" name="lo" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="127.0.0.1" comment="" id="id41528C82" name="rh90:lo:ip" netmask="255.0.0.0"/>
+        </Policy>
+        <Routing id="id41528C2C-routing" name="Routing"/>
+        <Interface bridgeport="False" comment="" dyn="False" id="id41528C53" label="outside" mgmt="True" name="eth0" security_level="0" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id41528C88" name="rh90:eth0:ip" address="10.3.14.58" netmask="255.255.255.0"/>
         </Interface>
-          <Management address="0.0.0.0">
+        <Interface bridgeport="False" comment="" dyn="False" id="id41528C6A" label="loopback" mgmt="False" name="lo" security_level="100" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id41528C82" name="rh90:lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
+        </Interface>
+        <Management address="0.0.0.0">
           <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
           <FWBDManagement enabled="False" identity="" port="-1"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">true</Option>
           <Option name="accept_new_tcp_with_no_syn">true</Option>
           <Option name="activation">
@@ -12753,7 +14280,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="ulog_nlgroup">1</Option>
           <Option name="verify_interfaces">true</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="this firewall uses iptables-restore format. Firewall has wildcard interface ppp*; script is generated dynamically and then piped to iptables-restore&#10;" host_OS="linux24" id="id417C680B" lastCompiled="1188097057" lastInstalled="1142003872" lastModified="1142003913" name="firewall25" platform="iptables" ro="False" version="">
         <NAT id="id417C688D" name="NAT">
           <NATRule disabled="False" id="id417C688E" position="0">
@@ -12776,7 +14303,8 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id417C689C" position="1">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id417C689C" position="1">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -12796,7 +14324,8 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id417C68AA" position="2">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id417C68AA" position="2">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -12816,7 +14345,8 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <ServiceRef ref="tcp-SSH"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id417C68B8" position="3">
+          </NATRule>
+          <NATRule disabled="False" id="id417C68B8" position="3">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -12836,18 +14366,23 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule></NAT>
-          <Policy id="id417C6810" name="Policy">
+          </NATRule>
+        </NAT>
+        <Policy id="id417C6810" name="Policy">
           <PolicyRule action="Deny" comment="ppp clients get addresses on 10.1.1.0" direction="Inbound" disabled="False" id="id417C68FE" log="True" position="0">
             <Src neg="True">
               <ObjectRef ref="id3EFBCCBA"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id417C68C6"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -12857,13 +14392,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" comment="ppp clients can not connect to the firewall" direction="Inbound" disabled="False" id="id417C6908" log="True" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id417C68C6"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id417C68C6"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -12873,13 +14412,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" direction="Inbound" disabled="False" id="id417C6912" log="True" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id417C680B"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id417C68C6"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -12889,14 +14432,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="ppp clients can only connect to the mail&#10;server and web proxy on DMZ" direction="Inbound" disabled="False" id="id417C691C" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3D151943"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SMTP"/>
               <ServiceRef ref="id3B4FF09A"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id417C68C6"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -12904,14 +14451,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" comment="ppp clients can not connect to&#10;anything else on DMZ and&#10;internal net" direction="Inbound" disabled="False" id="id417C6927" log="True" position="4">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B022266"/>
               <ObjectRef ref="net-Internal_net"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id417C68C6"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -12921,13 +14472,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" comment="" direction="Inbound" disabled="False" id="id417C6946" log="True" position="5">
             <Src neg="True">
               <ObjectRef ref="id3B022266"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id417C6938"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -12937,29 +14492,37 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="hostF has the same IP address as firewal." disabled="False" id="id417C6811" log="True" position="6">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3AFC191C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="icmp-ping_request"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Accept" disabled="False" id="id417C681B" log="False" position="7">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id417C680B"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -12967,13 +14530,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="" disabled="False" id="id417C6825" log="False" position="8">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id417C68C6"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -12981,13 +14548,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="" disabled="False" id="id417C682F" log="False" position="9">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B19BF58"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -12995,14 +14566,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" disabled="False" id="id417C6839" log="False" position="10">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3AFC191C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
               <ServiceRef ref="tcp-Telnet"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -13010,14 +14585,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="" disabled="False" id="id417C6844" log="False" position="11">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3E9870D1"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
               <ServiceRef ref="tcp-Telnet"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -13025,14 +14604,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="" disabled="False" id="id417C684F" log="True" position="12">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3E9870D1"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
               <ServiceRef ref="tcp-Telnet"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -13040,13 +14623,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="firewall is part of Any, so compiler should&#10;generate code in both FORWARD and&#10;OUTPUT chains" disabled="False" id="id417C685A" log="False" position="13">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B19C5EB"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -13054,13 +14641,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="firewall is part of Any, compiler should&#10;generate code for both FORWARD and&#10;INPUT chains" disabled="False" id="id417C6864" log="False" position="14">
             <Src neg="False">
               <ObjectRef ref="id3B19C5EB"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -13068,13 +14659,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="because firewall has interface on network&#10;internal_net, compiler should generate code&#10;for both FORWARD and INPUT chains" disabled="False" id="id417C686E" log="False" position="15">
             <Src neg="False">
               <ObjectRef ref="host-hostA"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -13083,13 +14678,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B19C5EB"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -13097,98 +14696,101 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" comment="Automatically generated 'catch all' rule" disabled="False" id="id417C6883" log="True" position="17">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="id"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="id"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id417C680B-routing" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="" dyn="True" id="id417C68C6" label="" mgmt="False" name="ppp*" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.1" comment="" id="id417C6932" name="firewall25:ppp*:ip" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id417C6933" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.1" id="id417C6937" name="firewall25:eth0:ip" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id417C6938" name="eth2" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="192.168.2.1" id="id417C6950" name="firewall25:eth2:ip" netmask="255.255.255.0"/>
+        </Policy>
+        <Routing id="id417C680B-routing" name="Routing"/>
+        <Interface bridgeport="False" comment="" dyn="True" id="id417C68C6" label="" mgmt="False" name="ppp*" security_level="0" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id417C6932" name="firewall25:ppp*:ip" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-          <Management address="192.168.1.1">
+        <Interface bridgeport="False" comment="" dyn="False" id="id417C6933" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id417C6937" name="firewall25:eth0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" dyn="False" id="id417C6938" name="eth2" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id417C6950" name="firewall25:eth2:ip" address="192.168.2.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Management address="192.168.1.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">False</Option>
           <Option name="action_on_reject">ICMP host prohibited</Option>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">True</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="epilog_script"/>
-          <Option name="firewall_dir"/>
+          <Option name="epilog_script"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
-          <Option name="id"/>
+          <Option name="id"></Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="install_script"/>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">False</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
           <Option name="log_all_dropped">False</Option>
           <Option name="log_invalid">False</Option>
           <Option name="log_ip_opt">False</Option>
-          <Option name="log_level"/>
-          <Option name="log_limit_suffix"/>
+          <Option name="log_level"></Option>
+          <Option name="log_limit_suffix"></Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
@@ -13196,13 +14798,13 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="mgmt_ssh">True</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="platform">iptables</Option>
-          <Option name="prolog_script"/>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="prolog_script"></Option>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -13211,7 +14813,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">True</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="this firewall uses iptables-restore format&#10;One interface has dynamic address, script uses echo to generated iptables commands and then pipes them to iptables-restore" host_OS="linux24" id="id418C4609" lastCompiled="1188097064" lastInstalled="1142003872" lastModified="1142003913" name="firewall26" platform="iptables" ro="False" version="">
         <NAT id="id418C468B" name="NAT">
           <NATRule disabled="False" id="id418C468C" position="0">
@@ -13234,7 +14836,8 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id418C469A" position="1">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id418C469A" position="1">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -13254,7 +14857,8 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id418C46A8" position="2">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id418C46A8" position="2">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -13274,7 +14878,8 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <ServiceRef ref="tcp-SSH"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id418C46B6" position="3">
+          </NATRule>
+          <NATRule disabled="False" id="id418C46B6" position="3">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -13294,18 +14899,23 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule></NAT>
-          <Policy id="id418C460E" name="Policy">
+          </NATRule>
+        </NAT>
+        <Policy id="id418C460E" name="Policy">
           <PolicyRule action="Deny" comment="ppp clients get addresses on 10.1.1.0" direction="Inbound" disabled="False" id="id418C46FC" log="True" position="0">
             <Src neg="True">
               <ObjectRef ref="id3EFBCCBA"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id418C46C4"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -13315,13 +14925,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" comment="ppp clients can not connect to the firewall" direction="Inbound" disabled="False" id="id418C4706" log="True" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id418C46C4"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id418C46C4"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -13331,13 +14945,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" direction="Inbound" disabled="False" id="id418C4710" log="True" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id418C4609"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id418C46C4"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -13347,14 +14965,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="ppp clients can only connect to the mail&#10;server and web proxy on DMZ" direction="Inbound" disabled="False" id="id418C471A" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3D151943"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SMTP"/>
               <ServiceRef ref="id3B4FF09A"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id418C46C4"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -13362,14 +14984,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" comment="ppp clients can not connect to&#10;anything else on DMZ and&#10;internal net" direction="Inbound" disabled="False" id="id418C4725" log="True" position="4">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B022266"/>
               <ObjectRef ref="net-Internal_net"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id418C46C4"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -13379,13 +15005,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" comment="" direction="Inbound" disabled="False" id="id418C4744" log="True" position="5">
             <Src neg="True">
               <ObjectRef ref="id3B022266"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id418C4736"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -13395,29 +15025,37 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="hostF has the same IP address as firewal." disabled="False" id="id418C460F" log="True" position="6">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3AFC191C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="icmp-ping_request"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Accept" disabled="False" id="id418C4619" log="False" position="7">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id418C4609"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -13425,13 +15063,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="" disabled="False" id="id418C4623" log="False" position="8">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id418C46C4"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -13439,13 +15081,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="" disabled="False" id="id418C462D" log="False" position="9">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B19BF58"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -13453,14 +15099,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" disabled="False" id="id418C4637" log="False" position="10">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3AFC191C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
               <ServiceRef ref="tcp-Telnet"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -13468,14 +15118,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="" disabled="False" id="id418C4642" log="False" position="11">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3E9870D1"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
               <ServiceRef ref="tcp-Telnet"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -13483,14 +15137,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="" disabled="False" id="id418C464D" log="True" position="12">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3E9870D1"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
               <ServiceRef ref="tcp-Telnet"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -13498,13 +15156,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="firewall is part of Any, so compiler should&#10;generate code in both FORWARD and&#10;OUTPUT chains" disabled="False" id="id418C4658" log="False" position="13">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B19C5EB"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -13512,13 +15174,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="firewall is part of Any, compiler should&#10;generate code for both FORWARD and&#10;INPUT chains" disabled="False" id="id418C4662" log="False" position="14">
             <Src neg="False">
               <ObjectRef ref="id3B19C5EB"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -13526,13 +15192,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="because firewall has interface on network&#10;internal_net, compiler should generate code&#10;for both FORWARD and INPUT chains" disabled="False" id="id418C466C" log="False" position="15">
             <Src neg="False">
               <ObjectRef ref="host-hostA"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -13541,13 +15211,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B19C5EB"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -13555,96 +15229,99 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" comment="Automatically generated 'catch all' rule" disabled="False" id="id418C4681" log="True" position="17">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="id"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="id"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id418C4609-routing" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="" dyn="True" id="id418C46C4" label="" mgmt="False" name="ppp" security_level="0" unnum="False" unprotected="False"/><Interface bridgeport="False" comment="" dyn="False" id="id418C4731" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.1" id="id418C4735" name="firewall26:eth0:ip" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id418C4736" name="eth2" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="192.168.2.1" id="id418C474E" name="firewall26:eth2:ip" netmask="255.255.255.0"/>
+        </Policy>
+        <Routing id="id418C4609-routing" name="Routing"/>
+        <Interface bridgeport="False" comment="" dyn="True" id="id418C46C4" label="" mgmt="False" name="ppp" security_level="0" unnum="False" unprotected="False"/>
+        <Interface bridgeport="False" comment="" dyn="False" id="id418C4731" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id418C4735" name="firewall26:eth0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-          <Management address="192.168.1.1">
+        <Interface bridgeport="False" dyn="False" id="id418C4736" name="eth2" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id418C474E" name="firewall26:eth2:ip" address="192.168.2.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Management address="192.168.1.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">False</Option>
           <Option name="action_on_reject">ICMP host prohibited</Option>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">True</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="epilog_script"/>
-          <Option name="firewall_dir"/>
+          <Option name="epilog_script"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
-          <Option name="id"/>
+          <Option name="id"></Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="install_script"/>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">False</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
           <Option name="log_all_dropped">False</Option>
           <Option name="log_invalid">False</Option>
           <Option name="log_ip_opt">False</Option>
-          <Option name="log_level"/>
-          <Option name="log_limit_suffix"/>
+          <Option name="log_level"></Option>
+          <Option name="log_limit_suffix"></Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
@@ -13652,13 +15329,13 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="mgmt_ssh">True</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="platform">iptables</Option>
-          <Option name="prolog_script"/>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="prolog_script"></Option>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -13667,7 +15344,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">True</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="this firewall uses iptables-restore format&#10;all interfaces have static addresses, script pipes iptables commands straight to iptables-restore" host_OS="linux24" id="id4183D041" inactive="False" lastCompiled="1197477543" lastInstalled="1142003872" lastModified="1197477519" name="firewall27" platform="iptables" ro="False" version="">
         <NAT id="id4183D0C3" name="NAT">
           <NATRule disabled="False" id="id4183D0C4" position="0">
@@ -13690,7 +15367,8 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id4183D0D2" position="1">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id4183D0D2" position="1">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -13710,7 +15388,8 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id4183D0E0" position="2">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id4183D0E0" position="2">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -13730,7 +15409,8 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <ServiceRef ref="tcp-SSH"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id4183D0EE" position="3">
+          </NATRule>
+          <NATRule disabled="False" id="id4183D0EE" position="3">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -13750,18 +15430,23 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule></NAT>
-          <Policy id="id4183D046" name="Policy">
+          </NATRule>
+        </NAT>
+        <Policy id="id4183D046" name="Policy">
           <PolicyRule action="Deny" comment="ppp clients get addresses on 10.1.1.0" direction="Inbound" disabled="False" id="id4183D133" log="True" position="0">
             <Src neg="True">
               <ObjectRef ref="id3EFBCCBA"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id4183D0FC"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -13771,13 +15456,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" comment="ppp clients can not connect to the firewall" direction="Inbound" disabled="False" id="id4183D13D" log="True" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id4183D0FC"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id4183D0FC"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -13787,13 +15476,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" direction="Inbound" disabled="False" id="id4183D147" log="True" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id4183D041"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id4183D0FC"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -13803,14 +15496,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="ppp clients can only connect to the mail&#10;server and web proxy on DMZ" direction="Inbound" disabled="False" id="id4183D151" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3D151943"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SMTP"/>
               <ServiceRef ref="id3B4FF09A"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id4183D0FC"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -13818,14 +15515,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" comment="ppp clients can not connect to&#10;anything else on DMZ and&#10;internal net" direction="Inbound" disabled="False" id="id4183D15C" log="True" position="4">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B022266"/>
               <ObjectRef ref="net-Internal_net"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id4183D0FC"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -13835,13 +15536,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" comment="" direction="Inbound" disabled="False" id="id4183D17A" log="True" position="5">
             <Src neg="True">
               <ObjectRef ref="id3B022266"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id4183D16C"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -13851,29 +15556,37 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="hostF has the same IP address as firewal." disabled="False" id="id4183D047" log="True" position="6">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3AFC191C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="icmp-ping_request"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="id"/>
+              <Option name="id"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Accept" disabled="False" id="id4183D051" log="False" position="7">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id4183D041"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -13881,13 +15594,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="" disabled="False" id="id4183D05B" log="False" position="8">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id4183D0FC"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -13895,13 +15612,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="" disabled="False" id="id4183D065" log="False" position="9">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B19BF58"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -13909,14 +15630,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" disabled="False" id="id4183D06F" log="False" position="10">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3AFC191C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
               <ServiceRef ref="tcp-Telnet"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -13924,14 +15649,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="" disabled="False" id="id4183D07A" log="False" position="11">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3E9870D1"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
               <ServiceRef ref="tcp-Telnet"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -13939,14 +15668,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="" disabled="False" id="id4183D085" log="True" position="12">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3E9870D1"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
               <ServiceRef ref="tcp-Telnet"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -13954,13 +15687,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="firewall is part of Any, so compiler should&#10;generate code in both FORWARD and&#10;OUTPUT chains" disabled="False" id="id4183D090" log="False" position="13">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B19C5EB"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -13968,13 +15705,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="firewall is part of Any, compiler should&#10;generate code for both FORWARD and&#10;INPUT chains" disabled="False" id="id4183D09A" log="False" position="14">
             <Src neg="False">
               <ObjectRef ref="id3B19C5EB"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -13982,13 +15723,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="because firewall has interface on network&#10;internal_net, compiler should generate code&#10;for both FORWARD and INPUT chains" disabled="False" id="id4183D0A4" log="False" position="15">
             <Src neg="False">
               <ObjectRef ref="host-hostA"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -13997,13 +15742,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B19C5EB"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -14011,98 +15760,101 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" comment="Automatically generated 'catch all' rule" disabled="False" id="id4183D0B9" log="True" position="17">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="id"/>
-              <Option name="limit_suffix"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="id"></Option>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_prefix"/>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id4183D041-routing" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="" dyn="False" id="id4183D0FC" label="" mgmt="False" name="ppp" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="192.0.2.1" comment="" id="id4183D18A" name="firewall27:ppp:ip" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id4183D167" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.1" id="id4183D16B" name="firewall27:eth0:ip" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id4183D16C" name="eth2" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="192.168.2.1" id="id4183D184" name="firewall27:eth2:ip" netmask="255.255.255.0"/>
+        </Policy>
+        <Routing id="id4183D041-routing" name="Routing"/>
+        <Interface bridgeport="False" comment="" dyn="False" id="id4183D0FC" label="" mgmt="False" name="ppp" security_level="0" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id4183D18A" name="firewall27:ppp:ip" address="192.0.2.1" netmask="255.255.255.0"/>
         </Interface>
-          <Management address="192.168.1.1">
+        <Interface bridgeport="False" comment="" dyn="False" id="id4183D167" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id4183D16B" name="firewall27:eth0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" dyn="False" id="id4183D16C" name="eth2" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id4183D184" name="firewall27:eth2:ip" address="192.168.2.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Management address="192.168.1.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">False</Option>
           <Option name="action_on_reject">ICMP host prohibited</Option>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">True</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="epilog_script"/>
-          <Option name="firewall_dir"/>
+          <Option name="epilog_script"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
-          <Option name="id"/>
+          <Option name="id"></Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="install_script"/>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">False</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
           <Option name="log_all_dropped">False</Option>
           <Option name="log_invalid">False</Option>
           <Option name="log_ip_opt">False</Option>
-          <Option name="log_level"/>
-          <Option name="log_limit_suffix"/>
+          <Option name="log_level"></Option>
+          <Option name="log_limit_suffix"></Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
@@ -14110,13 +15862,13 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="mgmt_ssh">True</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="platform">iptables</Option>
-          <Option name="prolog_script"/>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="prolog_script"></Option>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -14125,7 +15877,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">True</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="&#10;" host_OS="linux24" id="id419DC88E" lastCompiled="1142003872" lastInstalled="1142003872" lastModified="0" name="firewall28" platform="iptables" ro="False" version="">
         <NAT id="id419DC8B2" name="NAT">
           <NATRule comment="" disabled="False" id="id419DC8C1" position="0">
@@ -14148,18 +15900,23 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule></NAT>
-          <Policy id="id419DC893" name="Policy">
+          </NATRule>
+        </NAT>
+        <Policy id="id419DC893" name="Policy">
           <PolicyRule action="Accept" comment="this rule should shadow rule #1 because&#10;it uses IPService object with protocol 0" disabled="False" id="id419DC894" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id419D6869"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -14167,13 +15924,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" comment="" disabled="False" id="id419E8B1F" log="True" position="1">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-IRC"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -14183,13 +15944,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" disabled="False" id="id419DC89E" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -14197,77 +15962,79 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" disabled="False" id="id419DC8A8" log="True" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id419DC88E-routing" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="" dyn="False" id="id419DC8CF" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.0" comment="" id="id419DC8D3" name="firewall28:eth0:ip" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id419DC8D4" label="" mgmt="False" name="eth1" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="22.22.23.22" id="id419DC8D8" name="firewall28:eth1:ip" netmask="255.255.255.0"/>
+        </Policy>
+        <Routing id="id419DC88E-routing" name="Routing"/>
+        <Interface bridgeport="False" comment="" dyn="False" id="id419DC8CF" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id419DC8D3" name="firewall28:eth0:ip" address="192.168.1.0" netmask="255.255.255.0"/>
         </Interface>
-          <Management address="22.22.22.22">
+        <Interface bridgeport="False" comment="" dyn="False" id="id419DC8D4" label="" mgmt="False" name="eth1" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id419DC8D8" name="firewall28:eth1:ip" address="22.22.23.22" netmask="255.255.255.0"/>
+        </Interface>
+        <Management address="22.22.22.22">
           <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP host prohibited</Option>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">True</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
-          <Option name="epilog_script"/>
-          <Option name="firewall_dir"/>
+          <Option name="epilog_script"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">True</Option>
-          <Option name="limit_suffix"/>
+          <Option name="limit_suffix"></Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">True</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -14279,15 +16046,15 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="prolog_script"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -14296,7 +16063,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="two dynamic interfaces in the same policy or NAT rule. Interfaces have a dot in their names&#10;" host_OS="linux24" id="id41D2945B" lastCompiled="1188097084" lastInstalled="1142003872" lastModified="0" name="firewall29" platform="iptables" ro="False" version="">
         <NAT id="id41D29482" name="NAT">
           <NATRule disabled="False" id="id41D29483" position="0">
@@ -14320,18 +16087,23 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule></NAT>
-          <Policy id="id41D29460" name="Policy">
+          </NATRule>
+        </NAT>
+        <Policy id="id41D29460" name="Policy">
           <PolicyRule action="Accept" direction="Outbound" disabled="False" id="id41D2949F" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="id41D29492"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id41D29492"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -14341,13 +16113,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id41D29492"/>
               <ObjectRef ref="id41D294A9"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -14355,14 +16131,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" disabled="False" id="id41D2946D" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3F6D17F4"/>
               <ObjectRef ref="id41D29492"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sg-DHCP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -14370,76 +16150,80 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" disabled="False" id="id41D29478" log="True" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id41D2945B-routing" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="VLAN interface" dyn="True" id="id41D29492" label="" mgmt="False" name="eth0.200" security_level="0" unnum="False" unprotected="False"/><Interface bridgeport="False" comment="VLAN interface" dyn="True" id="id41D294A9" label="" mgmt="False" name="eth0.100" security_level="0" unnum="False" unprotected="False"/><Interface bridgeport="False" dyn="False" id="id41D294AC" name="lo" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="127.0.0.1" id="id41D294B0" name="firewall29:lo:ip" netmask="255.0.0.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id41D294B1" label="" mgmt="True" name="eth1" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.100" comment="" id="id41D294B5" name="firewall29:eth1:ip" netmask="255.255.255.0"/>
+        </Policy>
+        <Routing id="id41D2945B-routing" name="Routing"/>
+        <Interface bridgeport="False" comment="VLAN interface" dyn="True" id="id41D29492" label="" mgmt="False" name="eth0.200" security_level="0" unnum="False" unprotected="False"/>
+        <Interface bridgeport="False" comment="VLAN interface" dyn="True" id="id41D294A9" label="" mgmt="False" name="eth0.100" security_level="0" unnum="False" unprotected="False"/>
+        <Interface bridgeport="False" dyn="False" id="id41D294AC" name="lo" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id41D294B0" name="firewall29:lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
-          <Management address="192.168.1.100">
+        <Interface bridgeport="False" comment="" dyn="False" id="id41D294B1" label="" mgmt="True" name="eth1" security_level="100" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id41D294B5" name="firewall29:eth1:ip" address="192.168.1.100" netmask="255.255.255.0"/>
+        </Interface>
+        <Management address="192.168.1.100">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">False</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -14456,10 +16240,10 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="no_optimisation">False</Option>
           <Option name="platform">iptables</Option>
           <Option name="proxy_arp">False</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -14468,21 +16252,24 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="testing shading of rules using MAC addresses" host_OS="linux24" id="id41F62B80" lastCompiled="1188097099" lastInstalled="1142003872" lastModified="0" name="firewall30" platform="iptables" ro="False" version="">
-        <NAT id="id41F62BA4" name="NAT">
-          </NAT>
-          <Policy id="id41F62B85" name="Policy">
+        <NAT id="id41F62BA4" name="NAT"/>
+        <Policy id="id41F62B85" name="Policy">
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id41F62B86" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="id3BF1B3E2-pa"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -14490,13 +16277,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id41F62B90" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="id3BF1B3E8-pa"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -14504,78 +16295,81 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id41F62B9A" log="True" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id41F62B80-routing" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="" dyn="False" id="id41F62C34" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.1" id="id41F62C38" name="firewall30:eth0:ip" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id41F62C39" name="eth1" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="22.22.22.22" id="id41F62C51" name="firewall30:eth1:ip" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id41F62C57" name="lo" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="127.0.0.1" id="id41F62C5B" name="firewall30:lo:ip" netmask="255.0.0.0"/>
+        </Policy>
+        <Routing id="id41F62B80-routing" name="Routing"/>
+        <Interface bridgeport="False" comment="" dyn="False" id="id41F62C34" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id41F62C38" name="firewall30:eth0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-          <Management address="192.168.1.1">
+        <Interface bridgeport="False" dyn="False" id="id41F62C39" name="eth1" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id41F62C51" name="firewall30:eth1:ip" address="22.22.22.22" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" dyn="False" id="id41F62C57" name="lo" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id41F62C5B" name="firewall30:lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
+        </Interface>
+        <Management address="192.168.1.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">True</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">False</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -14592,10 +16386,10 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="no_optimisation">False</Option>
           <Option name="platform">iptables</Option>
           <Option name="proxy_arp">False</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -14604,21 +16398,24 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="used to test time matching rules" host_OS="linux24" id="id429910D5" lastCompiled="1188097105" lastInstalled="1142003872" lastModified="0" name="firewall31" platform="iptables" ro="False" version="">
-        <NAT id="id429910DB" name="NAT">
-          </NAT>
-          <Policy id="id429910DA" name="Policy">
+        <NAT id="id429910DB" name="NAT"/>
+        <Policy id="id429910DA" name="Policy">
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id4299E22F" log="True" position="0">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="id3C63479C"/>
             </When>
             <PolicyRuleOptions>
@@ -14628,13 +16425,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id4299E223" log="True" position="1">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="int-afterhours"/>
             </When>
             <PolicyRuleOptions/>
@@ -14642,13 +16443,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id429910F3" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="int-weekends"/>
             </When>
             <PolicyRuleOptions/>
@@ -14656,13 +16461,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id4299E253" log="True" position="3">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="int-workhours"/>
             </When>
             <PolicyRuleOptions/>
@@ -14670,13 +16479,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id4299E23B" log="True" position="4">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="True">
+            </Itf>
+            <When neg="True">
               <IntervalRef ref="int-weekends"/>
             </When>
             <PolicyRuleOptions/>
@@ -14684,13 +16497,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id4299E247" log="True" position="5">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="True">
+            </Itf>
+            <When neg="True">
               <IntervalRef ref="id3C63479C"/>
               <IntervalRef ref="id3C63479E"/>
             </When>
@@ -14699,78 +16516,81 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id429910FD" log="True" position="6">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id429910D5-routing" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="" dyn="False" id="id429910DC" label="" mgmt="False" name="eth0" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="33.33.33.33" id="id429910E0" name="firewall31:eth0:ip" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id429910E1" label="" mgmt="False" name="eth1" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.1" comment="" id="id429910E5" name="firewall31:eth1:ip" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="True" id="id429910EB" label="" mgmt="False" name="ppp0" security_level="0" unnum="False" unprotected="False"/>
-          <Management address="0.0.0.0">
+        </Policy>
+        <Routing id="id429910D5-routing" name="Routing"/>
+        <Interface bridgeport="False" comment="" dyn="False" id="id429910DC" label="" mgmt="False" name="eth0" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id429910E0" name="firewall31:eth0:ip" address="33.33.33.33" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" comment="" dyn="False" id="id429910E1" label="" mgmt="False" name="eth1" security_level="100" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id429910E5" name="firewall31:eth1:ip" address="192.168.1.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" comment="" dyn="True" id="id429910EB" label="" mgmt="False" name="ppp0" security_level="0" unnum="False" unprotected="False"/>
+        <Management address="0.0.0.0">
           <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP host prohibited</Option>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="epilog_script"/>
-          <Option name="firewall_dir"/>
+          <Option name="epilog_script"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">True</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -14782,17 +16602,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"/>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
-          <Option name="sshArgs"/>
+          <Option name="prolog_script"></Option>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -14801,7 +16621,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="testing AddressTable" host_OS="linux24" id="id43868A331434" lastCompiled="1188097112" lastInstalled="1142003872" lastModified="0" name="firewall32" platform="iptables" ro="False" version="">
         <NAT id="id43868A6D1434" name="NAT">
           <NATRule disabled="False" id="id43868A6E1434" position="0">
@@ -14824,19 +16644,24 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule></NAT>
-          <Policy id="id43868A391434" name="Policy">
+          </NATRule>
+        </NAT>
+        <Policy id="id43868A391434" name="Policy">
           <PolicyRule action="Deny" direction="Inbound" disabled="False" id="id43868A461434" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id43868A7F1434"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id43868A7F1434"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -14846,13 +16671,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id4386CE421434" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="id4385C1081434"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -14860,13 +16689,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id43868A541434" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3F6D17F4"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sg-DHCP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -14874,82 +16707,85 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id43868A611434" log="True" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id43868A7D1434" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="VLAN interface" dyn="True" id="id43868A7F1434" label="" mgmt="False" name="eth0.100" security_level="0" unnum="False" unprotected="False"/><Interface bridgeport="False" dyn="False" id="id43868A801434" name="lo" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="127.0.0.1" id="id43868A821434" name="firewall32:lo:ip" netmask="255.0.0.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id43868A831434" label="" mgmt="True" name="eth1" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.100" comment="" id="id43868A851434" name="firewall32:eth1:ip" netmask="255.255.255.0"/>
+        </Policy>
+        <Routing id="id43868A7D1434" name="Routing"/>
+        <Interface bridgeport="False" comment="VLAN interface" dyn="True" id="id43868A7F1434" label="" mgmt="False" name="eth0.100" security_level="0" unnum="False" unprotected="False"/>
+        <Interface bridgeport="False" dyn="False" id="id43868A801434" name="lo" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id43868A821434" name="firewall32:lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
-          <Management address="192.168.1.100">
+        <Interface bridgeport="False" comment="" dyn="False" id="id43868A831434" label="" mgmt="True" name="eth1" security_level="100" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id43868A851434" name="firewall32:eth1:ip" address="192.168.1.100" netmask="255.255.255.0"/>
+        </Interface>
+        <Management address="192.168.1.100">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="epilog_script"/>
-          <Option name="firewall_dir"/>
+          <Option name="epilog_script"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">False</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -14963,20 +16799,20 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="platform">iptables</Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"/>
+          <Option name="prolog_script"></Option>
           <Option name="proxy_arp">False</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
-          <Option name="sshArgs"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -14986,7 +16822,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="testing DNSName object" host_OS="linux24" id="id43867C1018346" lastCompiled="1188097121" lastInstalled="1142003872" lastModified="1205119254" name="firewall33" platform="iptables" ro="False" version="">
         <NAT id="id43867C4818346" name="NAT">
           <NATRule disabled="False" id="id43867C4918346" position="0">
@@ -15009,7 +16845,8 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id43876E2618346" position="1">
+          </NATRule>
+          <NATRule disabled="False" id="id43876E2618346" position="1">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -15029,7 +16866,8 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule comment="" disabled="False" id="id43876E5218346" position="2">
+          </NATRule>
+          <NATRule comment="" disabled="False" id="id43876E5218346" position="2">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -15049,7 +16887,8 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id43876E6918346" position="3">
+          </NATRule>
+          <NATRule disabled="False" id="id43876E6918346" position="3">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -15070,7 +16909,8 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id43876E7B18346" position="4">
+          </NATRule>
+          <NATRule disabled="False" id="id43876E7B18346" position="4">
             <OSrc neg="False">
               <ObjectRef ref="sysid0"/>
             </OSrc>
@@ -15091,19 +16931,24 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule></NAT>
-          <Policy id="id43867C1618346" name="Policy">
+          </NATRule>
+        </NAT>
+        <Policy id="id43867C1618346" name="Policy">
           <PolicyRule action="Deny" direction="Inbound" disabled="False" id="id43867C1718346" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id43867C5818346"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id43867C5818346"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -15113,13 +16958,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id43867C2418346" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="id43869E8C18346"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -15127,13 +16976,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id43869E9018346" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="id43869E8D18346"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -15141,13 +16994,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id43869E9E18346" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="id43869E8E18346"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -15155,13 +17012,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id43869EAA18346" log="False" position="4">
             <Src neg="False">
               <ObjectRef ref="id43869E8F18346"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -15169,13 +17030,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id4386E38318346" log="False" position="5">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="id43869E8C18346"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -15185,13 +17050,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id4386E37718346" log="False" position="6">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="id43869E8D18346"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -15201,13 +17070,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id43867C3018346" log="False" position="7">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="id43869E8E18346"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -15215,13 +17088,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id4386C10D18346" log="False" position="8">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="id43869E8F18346"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -15229,14 +17106,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id438728A918346" log="False" position="9">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="id43869E8C18346"/>
               <ObjectRef ref="id4387287918346"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -15244,14 +17125,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id438728BA18346" log="False" position="10">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="id43869E8D18346"/>
               <ObjectRef ref="id4387287A18346"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -15259,14 +17144,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id438728CD18346" log="False" position="11">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="id43869E8C18346"/>
               <ObjectRef ref="id4387287A18346"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -15274,13 +17163,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="test for bug #1905718&#10;Group of DNS Name objects considered empty&#10;" direction="Both" disabled="False" id="id47CBF5D429252" log="False" position="12">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id47CBF5D129252"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -15291,82 +17184,85 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id43867C3C18346" log="True" position="13">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id43867C5718346" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="VLAN interface" dyn="True" id="id43867C5818346" label="" mgmt="False" name="eth0.100" security_level="0" unnum="False" unprotected="False"/><Interface bridgeport="False" dyn="False" id="id43867C5918346" name="lo" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="127.0.0.1" id="id43867C5B18346" name="firewall33:lo:ip" netmask="255.0.0.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id43867C5C18346" label="" mgmt="True" name="eth1" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.100" comment="" id="id43867C5E18346" name="firewall33:eth1:ip" netmask="255.255.255.0"/>
+        </Policy>
+        <Routing id="id43867C5718346" name="Routing"/>
+        <Interface bridgeport="False" comment="VLAN interface" dyn="True" id="id43867C5818346" label="" mgmt="False" name="eth0.100" security_level="0" unnum="False" unprotected="False"/>
+        <Interface bridgeport="False" dyn="False" id="id43867C5918346" name="lo" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id43867C5B18346" name="firewall33:lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
-          <Management address="192.168.1.100">
+        <Interface bridgeport="False" comment="" dyn="False" id="id43867C5C18346" label="" mgmt="True" name="eth1" security_level="100" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id43867C5E18346" name="firewall33:eth1:ip" address="192.168.1.100" netmask="255.255.255.0"/>
+        </Interface>
+        <Management address="192.168.1.100">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="epilog_script"/>
-          <Option name="firewall_dir"/>
+          <Option name="epilog_script"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">False</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -15380,20 +17276,20 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="platform">iptables</Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"/>
+          <Option name="prolog_script"></Option>
           <Option name="proxy_arp">False</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
-          <Option name="sshArgs"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -15403,7 +17299,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="testing AddressTable object" host_OS="linux24" id="id4389EDAE18346" inactive="False" lastCompiled="1188097128" lastInstalled="1142003872" lastModified="1167289689" name="firewall34" platform="iptables" ro="False" version="">
         <NAT id="id4389EE4818346" name="NAT">
           <NATRule disabled="False" id="id4389EEB018346" position="0">
@@ -15426,7 +17322,8 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id43891B6E674" position="1">
+          </NATRule>
+          <NATRule disabled="False" id="id43891B6E674" position="1">
             <OSrc neg="False">
               <ObjectRef ref="id43913DEA25682"/>
             </OSrc>
@@ -15446,18 +17343,23 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule></NAT>
-          <Policy id="id4389EDB418346" name="Policy">
+          </NATRule>
+        </NAT>
+        <Policy id="id4389EDB418346" name="Policy">
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id4389EDB518346" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id4389EE9018346"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -15467,13 +17369,13 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="hashlimit_burst">0</Option>
               <Option name="hashlimit_dstlimit">False</Option>
               <Option name="hashlimit_mode">dstip</Option>
-              <Option name="hashlimit_suffix"/>
+              <Option name="hashlimit_suffix"></Option>
               <Option name="hashlimit_value">0</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">False</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
@@ -15481,13 +17383,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id4388CFEA674" log="True" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id4389EE9118346"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -15497,13 +17403,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id4390C25825682" log="True" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id4390C25525682"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -15513,14 +17423,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id4389EDC118346" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id4389EE9118346"/>
               <ObjectRef ref="id4388C37D674"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SMTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -15530,14 +17444,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" comment="" direction="Both" disabled="False" id="id43920D5025682" log="False" position="4">
             <Src neg="False">
               <ObjectRef ref="id4389EE8418346"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id4389EE9118346"/>
               <ObjectRef ref="id4388C37D674"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SMTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -15547,13 +17465,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id4388CFF8674" log="True" position="5">
             <Src neg="False">
               <ObjectRef ref="id4389EE9118346"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -15564,13 +17486,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
             <Src neg="False">
               <ObjectRef ref="id4389EE9118346"/>
               <ObjectRef ref="id4388C37D674"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -15581,13 +17507,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
             <Src neg="True">
               <ObjectRef ref="id4389EE9118346"/>
               <ObjectRef ref="id4388C37D674"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -15595,14 +17525,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id4392312525682" log="False" position="8">
             <Src neg="False">
               <ObjectRef ref="id4389EE8418346"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="id4389EE9118346"/>
               <ObjectRef ref="id4388C37D674"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -15610,13 +17544,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id4389EEA118346" log="False" position="9">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id43913DCB25682"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SMTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -15624,13 +17562,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id4389EDCD18346" log="False" position="10">
             <Src neg="False">
               <ObjectRef ref="id43913DEA25682"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -15638,13 +17580,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id4389EE3C18346" log="True" position="11">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -15654,13 +17600,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" comment="using address table&#10;object with no addresses" direction="Both" disabled="False" id="id459673BF7794" log="True" position="12">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id459673BE7794"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -15670,13 +17620,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" comment="using address table&#10;object with no addresses" direction="Both" disabled="False" id="id45969FDB7794" log="True" position="13">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id45969FEC7794"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -15686,13 +17640,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="using connlimit&#10;option. Connlimit&#10;is only valid in combination&#10;with &quot;-p tcp -m tcp&quot;" direction="Both" disabled="False" id="id45948F957794" log="False" position="14">
             <Src neg="False">
               <ObjectRef ref="id43913DEA25682"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id4389EE9018346"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SMTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -15702,80 +17660,79 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="hashlimit_burst">0</Option>
               <Option name="hashlimit_dstlimit">False</Option>
               <Option name="hashlimit_mode">dstip</Option>
-              <Option name="hashlimit_suffix"/>
+              <Option name="hashlimit_suffix"></Option>
               <Option name="hashlimit_value">0</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">False</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id4389EE8318346" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="VLAN interface" dyn="True" id="id4389EE8418346" label="" mgmt="False" name="eth0.100" security_level="0" unnum="False" unprotected="False"/><Interface bridgeport="False" dyn="False" id="id4389EE8518346" name="lo" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="127.0.0.1" id="id4389EE8718346" name="firewall34:lo:ip" netmask="255.0.0.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id4389EE8818346" label="" mgmt="True" name="eth1" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.100" comment="" id="id4389EE8A18346" name="firewall34:eth1:ip" netmask="255.255.255.0"/>
+        </Policy>
+        <Routing id="id4389EE8318346" name="Routing"/>
+        <Interface bridgeport="False" comment="VLAN interface" dyn="True" id="id4389EE8418346" label="" mgmt="False" name="eth0.100" security_level="0" unnum="False" unprotected="False"/>
+        <Interface bridgeport="False" dyn="False" id="id4389EE8518346" name="lo" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id4389EE8718346" name="firewall34:lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
-          <Management address="192.168.1.100">
+        <Interface bridgeport="False" comment="" dyn="False" id="id4389EE8818346" label="" mgmt="True" name="eth1" security_level="100" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id4389EE8A18346" name="firewall34:eth1:ip" address="192.168.1.100" netmask="255.255.255.0"/>
+        </Interface>
+        <Management address="192.168.1.100">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="epilog_script"/>
-          <Option name="firewall_dir"/>
+          <Option name="epilog_script"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">True</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">False</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -15789,20 +17746,20 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="platform">iptables</Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"/>
+          <Option name="prolog_script"></Option>
           <Option name="proxy_arp">False</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
-          <Option name="sshArgs"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -15812,7 +17769,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="testing AddressTable object&#10;&#10;like firewall34, but uses different script format" host_OS="linux24" id="id439254F225682" lastCompiled="1188097135" lastInstalled="1142003872" lastModified="0" name="firewall35" platform="iptables" ro="False" version="">
         <NAT id="id4392558E25682" name="NAT">
           <NATRule disabled="False" id="id4392558F25682" position="0">
@@ -15835,7 +17792,8 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id4392559D25682" position="1">
+          </NATRule>
+          <NATRule disabled="False" id="id4392559D25682" position="1">
             <OSrc neg="False">
               <ObjectRef ref="id43913DEA25682"/>
             </OSrc>
@@ -15855,18 +17813,23 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule></NAT>
-          <Policy id="id439254F825682" name="Policy">
+          </NATRule>
+        </NAT>
+        <Policy id="id439254F825682" name="Policy">
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id439254F925682" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id4389EE9018346"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -15874,13 +17837,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id4392550525682" log="True" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id4389EE9118346"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -15890,13 +17857,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id4392551125682" log="True" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id4390C25525682"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -15906,14 +17877,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id4392551D25682" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id4389EE9118346"/>
               <ObjectRef ref="id4388C37D674"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SMTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -15923,14 +17898,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" comment="" direction="Both" disabled="False" id="id4392552A25682" log="False" position="4">
             <Src neg="False">
               <ObjectRef ref="id439255AC25682"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id4389EE9118346"/>
               <ObjectRef ref="id4388C37D674"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SMTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -15940,13 +17919,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id4392553725682" log="True" position="5">
             <Src neg="False">
               <ObjectRef ref="id4389EE9118346"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -15957,13 +17940,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
             <Src neg="False">
               <ObjectRef ref="id4389EE9118346"/>
               <ObjectRef ref="id4388C37D674"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -15974,13 +17961,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
             <Src neg="True">
               <ObjectRef ref="id4389EE9118346"/>
               <ObjectRef ref="id4388C37D674"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -15988,14 +17979,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id4392555D25682" log="False" position="8">
             <Src neg="False">
               <ObjectRef ref="id439255AC25682"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="id4389EE9118346"/>
               <ObjectRef ref="id4388C37D674"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -16003,13 +17998,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id4392556A25682" log="False" position="9">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id43913DCB25682"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SMTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -16017,13 +18016,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id4392557625682" log="False" position="10">
             <Src neg="False">
               <ObjectRef ref="id43913DEA25682"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -16031,82 +18034,85 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id4392558225682" log="True" position="11">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id439255AB25682" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="VLAN interface" dyn="True" id="id439255AC25682" label="" mgmt="False" name="eth0.100" security_level="0" unnum="False" unprotected="False"/><Interface bridgeport="False" dyn="False" id="id439255AD25682" name="lo" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="127.0.0.1" id="id439255AF25682" name="firewall35:lo:ip" netmask="255.0.0.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id439255B025682" label="" mgmt="True" name="eth1" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.100" comment="" id="id439255B225682" name="firewall35:eth1:ip" netmask="255.255.255.0"/>
+        </Policy>
+        <Routing id="id439255AB25682" name="Routing"/>
+        <Interface bridgeport="False" comment="VLAN interface" dyn="True" id="id439255AC25682" label="" mgmt="False" name="eth0.100" security_level="0" unnum="False" unprotected="False"/>
+        <Interface bridgeport="False" dyn="False" id="id439255AD25682" name="lo" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id439255AF25682" name="firewall35:lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
         </Interface>
-          <Management address="192.168.1.100">
+        <Interface bridgeport="False" comment="" dyn="False" id="id439255B025682" label="" mgmt="True" name="eth1" security_level="100" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id439255B225682" name="firewall35:eth1:ip" address="192.168.1.100" netmask="255.255.255.0"/>
+        </Interface>
+        <Management address="192.168.1.100">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="epilog_script"/>
-          <Option name="firewall_dir"/>
+          <Option name="epilog_script"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">False</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -16120,20 +18126,20 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="platform">iptables</Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"/>
+          <Option name="prolog_script"></Option>
           <Option name="proxy_arp">False</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
-          <Option name="sshArgs"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -16143,7 +18149,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="&#10;testing routing rules - both actually routing  and ROUTE target&#10;" host_OS="linux24" id="id43A2BF7416451" inactive="False" lastCompiled="1188097142" lastInstalled="1142003872" lastModified="1150347820" name="firewall36" platform="iptables" ro="False" version="">
         <NAT id="id43A2C00E16451" name="NAT">
           <NATRule comment="Translate source address&#10;for outgoing connections" disabled="False" id="id43A2C01D16451" position="0">
@@ -16166,18 +18172,23 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule></NAT>
-          <Policy id="id43A2BF7A16451" name="Policy">
+          </NATRule>
+        </NAT>
+        <Policy id="id43A2BF7A16451" name="Policy">
           <PolicyRule action="Accept" comment="This permits access from internal net&#10;to the Internet and DMZ" direction="Both" disabled="False" id="id43A2BFF616451" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -16185,213 +18196,235 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Route" direction="Both" disabled="False" id="id44925B5F24380" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3C20EEB5"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="branch_anchor_name"/>
-              <Option name="branch_chain_name"/>
-              <Option name="classify_str"/>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="branch_anchor_name"></Option>
+              <Option name="branch_chain_name"></Option>
+              <Option name="classify_str"></Option>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">Route through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_oif">eth1</Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">Route through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Route" direction="Both" disabled="False" id="id44925B6C24380" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-HTTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="branch_anchor_name"/>
-              <Option name="branch_chain_name"/>
-              <Option name="classify_str"/>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="branch_anchor_name"></Option>
+              <Option name="branch_chain_name"></Option>
+              <Option name="classify_str"></Option>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">Route through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">True</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_oif">eth1</Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">Route through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Route" direction="Both" disabled="False" id="id44925B7924380" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="branch_anchor_name"/>
-              <Option name="branch_chain_name"/>
-              <Option name="classify_str"/>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="branch_anchor_name"></Option>
+              <Option name="branch_chain_name"></Option>
+              <Option name="classify_str"></Option>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">Route through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">True</Option>
               <Option name="ipt_gw">1.2.3.4</Option>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">Route through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Route" direction="Both" disabled="False" id="id4492843F24380" log="False" position="4">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3C20EEB5"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="branch_anchor_name"/>
-              <Option name="branch_chain_name"/>
-              <Option name="classify_str"/>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="branch_anchor_name"></Option>
+              <Option name="branch_chain_name"></Option>
+              <Option name="classify_str"></Option>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">Route through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
+              <Option name="ipt_gw"></Option>
               <Option name="ipt_iif">eth1</Option>
               <Option name="ipt_mark_connections">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">Route through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Route" direction="Both" disabled="False" id="id4492844C24380" log="False" position="5">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3AEDBE6E"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="branch_anchor_name"/>
-              <Option name="branch_chain_name"/>
-              <Option name="classify_str"/>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="branch_anchor_name"></Option>
+              <Option name="branch_chain_name"></Option>
+              <Option name="classify_str"></Option>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">Route through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
               <Option name="ipt_gw">1.2.3.4</Option>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">True</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">Route through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id43A4EC5216451" log="True" position="6">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id43A2C03A16451" name="Routing">
+        </Policy>
+        <Routing id="id43A2C03A16451" name="Routing">
           <RoutingRule disabled="False" id="id43A3790B16451" metric="0" position="0">
             <RDst neg="False">
               <ObjectRef ref="sysid0"/>
@@ -16403,7 +18436,8 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <ObjectRef ref="id43A2C03B16451"/>
             </RItf>
             <RoutingRuleOptions/>
-          </RoutingRule><RoutingRule disabled="False" id="id43A3791416451" metric="0" position="1">
+          </RoutingRule>
+          <RoutingRule disabled="False" id="id43A3791416451" metric="0" position="1">
             <RDst neg="False">
               <ObjectRef ref="sysid0"/>
             </RDst>
@@ -16414,44 +18448,48 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <ObjectRef ref="id43A2C04416451"/>
             </RItf>
             <RoutingRuleOptions/>
-          </RoutingRule></Routing>
-          <Interface bridgeport="False" comment="" dyn="False" id="id43A2C03B16451" label="" mgmt="False" name="eth0" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="192.0.2.1" comment="This is a test address, change it to your real one" id="id43A2C03D16451" name="firewall36:eth0:ip" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id43A2C03E16451" label="" mgmt="True" name="eth1" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.1" comment="" id="id43A2C04016451" name="firewall36:eth1:ip" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id43A2C04116451" label="loopback" mgmt="False" name="lo" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="127.0.0.1" comment="" id="id43A2C04316451" name="firewall36:lo:ip" netmask="255.0.0.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id43A2C04416451" label="" mgmt="False" name="eth2" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="192.0.100.1" comment="" id="id43A2C04616451" name="firewall36:eth2:ip" netmask="255.255.255.0"/>
+          </RoutingRule>
+        </Routing>
+        <Interface bridgeport="False" comment="" dyn="False" id="id43A2C03B16451" label="" mgmt="False" name="eth0" security_level="0" unnum="False" unprotected="False">
+          <IPv4 comment="This is a test address, change it to your real one" id="id43A2C03D16451" name="firewall36:eth0:ip" address="192.0.2.1" netmask="255.255.255.0"/>
         </Interface>
-          <Management address="192.168.1.1">
+        <Interface bridgeport="False" comment="" dyn="False" id="id43A2C03E16451" label="" mgmt="True" name="eth1" security_level="100" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id43A2C04016451" name="firewall36:eth1:ip" address="192.168.1.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" comment="" dyn="False" id="id43A2C04116451" label="loopback" mgmt="False" name="lo" security_level="100" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id43A2C04316451" name="firewall36:lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
+        </Interface>
+        <Interface bridgeport="False" comment="" dyn="False" id="id43A2C04416451" label="" mgmt="False" name="eth2" security_level="0" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id43A2C04616451" name="firewall36:eth2:ip" address="192.0.100.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Management address="192.168.1.1">
           <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
           <FWBDManagement enabled="False" identity="" port="-1"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
-          <Option name="action_on_reject"/>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="action_on_reject"></Option>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">True</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="eliminate_duplicates">true</Option>
-          <Option name="epilog_script"/>
+          <Option name="epilog_script"></Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="freebsd_ip_forward">1</Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="in_out_code">true</Option>
-          <Option name="limit_suffix"/>
+          <Option name="limit_suffix"></Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">1</Option>
           <Option name="load_modules">True</Option>
@@ -16466,10 +18504,10 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="loopback_interface">lo0</Option>
           <Option name="macosx_ip_forward">1</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">false</Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
@@ -16489,11 +18527,11 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="pix_syslog_device_id_supported">false</Option>
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"/>
+          <Option name="prolog_script"></Option>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -16502,7 +18540,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">True</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="testing TAG and CLASSIFY rules&#10;&#10;normal script mode (not using  iptables-restore)" host_OS="linux24" id="id43BB80919745" inactive="False" lastCompiled="1211407377" lastInstalled="1142003872" lastModified="1211407366" name="firewall37" platform="iptables" ro="False" version="">
         <NAT id="id43BB80B09745" name="NAT">
           <NATRule comment="" disabled="False" id="id43BB814D9745" position="0">
@@ -16526,81 +18564,98 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule></NAT>
-          <Policy id="id43BB80979745" name="Policy">
+          </NATRule>
+        </NAT>
+        <Policy id="id43BB80979745" name="Policy">
           <PolicyRule action="Tag" direction="Both" disabled="False" id="id43BBA6A09745" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="color">#8BC065</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="tagvalue">16</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Tag" comment="" direction="Both" disabled="False" id="id43BBA6C49745" log="True" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="color">#8BC065</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="tagvalue">16</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Tag" comment="" direction="Both" disabled="False" id="id483502D710047" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="id43BB80919745"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="color">#8BC065</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="tagvalue">16</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Tag" comment="" direction="Both" disabled="False" id="id483502E810047" log="True" position="3">
             <Src neg="False">
               <ObjectRef ref="id43BB80919745"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="color">#8BC065</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="tagvalue">16</Option>
             </PolicyRuleOptions>
           </PolicyRule>
@@ -16608,126 +18663,150 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="color">#8BC065</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="tagvalue">16</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Tag" comment="" direction="Both" disabled="False" id="id4665E24F7765" log="False" position="5">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id43BB817C9745"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="color">#8BC065</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="tagvalue">16</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Tag" comment="" direction="Inbound" disabled="False" id="id43BBCC3D9745" log="False" position="6">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id43BB817C9745"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="color">#8BC065</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="tagvalue">16</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Tag" comment="" direction="Outbound" disabled="False" id="id459E471C10946" log="False" position="7">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id43BB817C9745"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="color">#8BC065</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="tagvalue">16</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Tag" comment="using CONNMARK" direction="Both" disabled="False" id="id4483A4BD1810" log="False" position="8">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="classify_str"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="classify_str"></Option>
               <Option name="color">#C08B5A</Option>
-              <Option name="custom_str"/>
+              <Option name="custom_str"></Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_mark_connections">True</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="tagvalue">10</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Tag" comment="using CONNMARK" direction="Both" disabled="False" id="id4483A4CE1810" log="True" position="9">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="classify_str"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="classify_str"></Option>
               <Option name="color">#C08B5A</Option>
-              <Option name="custom_str"/>
+              <Option name="custom_str"></Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_mark_connections">True</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="tagvalue">10</Option>
             </PolicyRuleOptions>
           </PolicyRule>
@@ -16735,88 +18814,104 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="classify_str"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="classify_str"></Option>
               <Option name="color">#C08B5A</Option>
-              <Option name="custom_str"/>
+              <Option name="custom_str"></Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_mark_connections">True</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="tagvalue">10</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Tag" comment="using CONNMARK" direction="Inbound" disabled="False" id="id4483A4F01810" log="False" position="11">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id43BB817C9745"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="classify_str"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="classify_str"></Option>
               <Option name="color">#C08B5A</Option>
-              <Option name="custom_str"/>
+              <Option name="custom_str"></Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_mark_connections">True</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="tagvalue">10</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Tag" comment="using CONNMARK" direction="Outbound" disabled="False" id="id459E472D10946" log="False" position="12">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id43BB817C9745"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="classify_str"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="classify_str"></Option>
               <Option name="color">#C08B5A</Option>
-              <Option name="custom_str"/>
+              <Option name="custom_str"></Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_mark_connections">True</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="tagvalue">10</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Pipe" direction="Both" disabled="False" id="id43BB80989745" log="False" position="13">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3D151943"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-HTTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -16826,17 +18921,21 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Classify" direction="Both" disabled="False" id="id43BB81879745" log="False" position="14">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="classify_str">1:2</Option>
               <Option name="color">#7694C0</Option>
               <Option name="custom_str">-j TCPMSS --set-mss 1400</Option>
@@ -16844,30 +18943,34 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="ipfw_pipe_method">0</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
-              <Option name="rule_name_accounting"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
-              <Option name="tagvalue"/>
+              <Option name="tagvalue"></Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Classify" comment="" direction="Both" disabled="False" id="id451E2B486383" log="True" position="15">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="classify_str">1:2</Option>
               <Option name="color">#7694C0</Option>
               <Option name="custom_str">-j TCPMSS --set-mss 1400</Option>
@@ -16875,13 +18978,13 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="ipfw_pipe_method">0</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
-              <Option name="rule_name_accounting"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
-              <Option name="tagvalue"/>
+              <Option name="tagvalue"></Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
           </PolicyRule>
@@ -16889,17 +18992,21 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="classify_str">1:2</Option>
               <Option name="color">#7694C0</Option>
               <Option name="custom_str">-j TCPMSS --set-mss 1400</Option>
@@ -16907,13 +19014,13 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="ipfw_pipe_method">0</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
-              <Option name="rule_name_accounting"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
-              <Option name="tagvalue"/>
+              <Option name="tagvalue"></Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
           </PolicyRule>
@@ -16921,17 +19028,21 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="classify_str">1:2</Option>
               <Option name="color">#7694C0</Option>
               <Option name="custom_str">-j TCPMSS --set-mss 1400</Option>
@@ -16939,30 +19050,34 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="ipfw_pipe_method">0</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
-              <Option name="rule_name_accounting"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
-              <Option name="tagvalue"/>
+              <Option name="tagvalue"></Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Classify" comment="" direction="Both" disabled="False" id="id451EAD596383" log="False" position="18">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id43BB817C9745"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="classify_str">1:2</Option>
               <Option name="color">#7694C0</Option>
               <Option name="custom_str">-j TCPMSS --set-mss 1400</Option>
@@ -16970,30 +19085,34 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="ipfw_pipe_method">0</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
-              <Option name="rule_name_accounting"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
-              <Option name="tagvalue"/>
+              <Option name="tagvalue"></Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Classify" comment="" direction="Both" disabled="False" id="id451EAD6A6383" log="True" position="19">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id43BB817C9745"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="classify_str">1:2</Option>
               <Option name="color">#7694C0</Option>
               <Option name="custom_str">-j TCPMSS --set-mss 1400</Option>
@@ -17001,30 +19120,34 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="ipfw_pipe_method">0</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
-              <Option name="rule_name_accounting"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
-              <Option name="tagvalue"/>
+              <Option name="tagvalue"></Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Classify" comment="" direction="Both" disabled="False" id="id451ED8E76383" log="False" position="20">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="True">
+            </Srv>
+            <Itf neg="True">
               <ObjectRef ref="id43BB817C9745"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="classify_str">1:2</Option>
               <Option name="color">#7694C0</Option>
               <Option name="custom_str">-j TCPMSS --set-mss 1400</Option>
@@ -17032,30 +19155,34 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="ipfw_pipe_method">0</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
-              <Option name="rule_name_accounting"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
-              <Option name="tagvalue"/>
+              <Option name="tagvalue"></Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Classify" comment="" direction="Both" disabled="False" id="id451ED8F86383" log="True" position="21">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="True">
+            </Srv>
+            <Itf neg="True">
               <ObjectRef ref="id43BB817C9745"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="classify_str">1:2</Option>
               <Option name="color">#7694C0</Option>
               <Option name="custom_str">-j TCPMSS --set-mss 1400</Option>
@@ -17063,89 +19190,97 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="ipfw_pipe_method">0</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
-              <Option name="rule_name_accounting"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
-              <Option name="tagvalue"/>
+              <Option name="tagvalue"></Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Classify" comment="testing for bug #1618381&#10;classify action is non-terminating&#10;in this firewall object" direction="Both" disabled="False" id="id4599A9DC19324" log="False" position="22">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="icmp-Unreachables"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="classify_str">1:10</Option>
               <Option name="color">#C0BA44</Option>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Classify" comment="second rule for bug #1618381" direction="Both" disabled="False" id="id4599A9E919324" log="False" position="23">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id43BB81799745"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="classify_str">1:11</Option>
               <Option name="color">#C0BA44</Option>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
@@ -17153,38 +19288,42 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="icmp-Unreachables"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="classify_str">1:10</Option>
               <Option name="color">#C0BA44</Option>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
@@ -17192,181 +19331,196 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="icmp-Unreachables"/>
               <ServiceRef ref="tcp-HTTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="classify_str">1:10</Option>
               <Option name="color">#C0BA44</Option>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Classify" comment="bug #1618381&#10;this rule uses multiport&#10;and has to be split because&#10;of that" direction="Both" disabled="False" id="id459A875F19324" log="False" position="26">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id41D0F023"/>
               <ServiceRef ref="id3D4DE626"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id43BB81799745"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="classify_str">1:11</Option>
               <Option name="color">#C0BA44</Option>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Custom" comment="" direction="Both" disabled="False" id="id43F46B8A28368" log="False" position="27">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="classify_str"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="classify_str"></Option>
               <Option name="color">#C0C0C0</Option>
               <Option name="custom_str">-j TCPMSS --set-mss 1400</Option>
               <Option name="ipfw_pipe_method">0</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
-              <Option name="tagvalue"/>
+              <Option name="tagvalue"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id43BB80A49745" log="True" position="28">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id43BB81789745" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="" dyn="False" id="id43BB81799745" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.22" comment="" id="id43BB817B9745" name="firewall37:eth0:ip" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id43BB817C9745" label="eth1(outside)" mgmt="False" name="eth1" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="22.22.23.22" comment="" id="id43BB817E9745" name="firewall37:eth1:ip" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id43BB817F9745" label="eth2(dmz)" mgmt="False" name="eth2" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="192.168.2.1" comment="this interface is on the subnet that overlaps with eth1" id="id43BB81819745" name="firewall37:eth2:ip" netmask="255.255.255.0"/>
+        </Policy>
+        <Routing id="id43BB81789745" name="Routing"/>
+        <Interface bridgeport="False" comment="" dyn="False" id="id43BB81799745" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id43BB817B9745" name="firewall37:eth0:ip" address="192.168.1.22" netmask="255.255.255.0"/>
         </Interface>
-          <Management address="192.168.1.22">
+        <Interface bridgeport="False" comment="" dyn="False" id="id43BB817C9745" label="eth1(outside)" mgmt="False" name="eth1" security_level="0" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id43BB817E9745" name="firewall37:eth1:ip" address="22.22.23.22" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" comment="" dyn="False" id="id43BB817F9745" label="eth2(dmz)" mgmt="False" name="eth2" security_level="0" unnum="False" unprotected="False">
+          <IPv4 comment="this interface is on the subnet that overlaps with eth1" id="id43BB81819745" name="firewall37:eth2:ip" address="192.168.2.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Management address="192.168.1.22">
           <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP host prohibited</Option>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
-          <Option name="epilog_script"/>
-          <Option name="firewall_dir"/>
+          <Option name="epilog_script"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">True</Option>
-          <Option name="limit_suffix"/>
+          <Option name="limit_suffix"></Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">True</Option>
           <Option name="local_nat">True</Option>
           <Option name="log_all">False</Option>
@@ -17378,15 +19532,15 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="prolog_script"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -17395,7 +19549,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="testing TAG rules&#10;&#10;using  iptables-restore&#10;" host_OS="linux24" id="id43BBF18E9745" lastCompiled="1188097164" lastInstalled="1142003872" lastModified="1177392195" name="firewall38" platform="iptables" ro="False" version="">
         <NAT id="id43BBF1E99745" name="NAT">
           <NATRule comment="" disabled="False" id="id43BBF1EA9745" position="0">
@@ -17419,7 +19573,8 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule><NATRule disabled="False" id="id43EC8B962279" position="1">
+          </NATRule>
+          <NATRule disabled="False" id="id43EC8B962279" position="1">
             <OSrc neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </OSrc>
@@ -17439,275 +19594,316 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule></NAT>
-          <Policy id="id43BBF1949745" name="Policy">
+          </NATRule>
+        </NAT>
+        <Policy id="id43BBF1949745" name="Policy">
           <PolicyRule action="Tag" direction="Both" disabled="False" id="id43BBF1959745" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="rule_name_accounting"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="rule_name_accounting"></Option>
               <Option name="tagvalue">16</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Tag" comment="" direction="Both" disabled="False" id="id43BBF1A19745" log="True" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="rule_name_accounting"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="rule_name_accounting"></Option>
               <Option name="tagvalue">16</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Tag" comment="" direction="Both" disabled="False" id="id43BBF1AD9745" log="True" position="2">
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="rule_name_accounting"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="rule_name_accounting"></Option>
               <Option name="tagvalue">16</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Tag" comment="" direction="Inbound" disabled="False" id="id43BBF1B99745" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id43BBF1FD9745"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="rule_name_accounting"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="rule_name_accounting"></Option>
               <Option name="tagvalue">16</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Tag" direction="Both" disabled="False" id="id462DEFE630547" log="False" position="4">
             <Src neg="False">
               <ObjectRef ref="id43BBF18E9745"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-HTTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="classify_str"/>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="classify_str"></Option>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="tagvalue">2</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Tag" direction="Both" disabled="False" id="id462E1E0230547" log="True" position="5">
             <Src neg="False">
               <ObjectRef ref="id43BBF1FD9745"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-HTTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="classify_str"/>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="classify_str"></Option>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="tagvalue">2</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Tag" comment="" direction="Outbound" disabled="False" id="id462E4C2A30547" log="False" position="6">
             <Src neg="False">
               <ObjectRef ref="id43BBF1FD9745"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-HTTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id43BBF1FD9745"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="classify_str"/>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="classify_str"></Option>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="tagvalue">2</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Tag" comment="" direction="Inbound" disabled="False" id="id462E4C3B30547" log="False" position="7">
             <Src neg="False">
               <ObjectRef ref="id43BBF1FD9745"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-HTTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id43BBF1FD9745"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="classify_str"/>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="classify_str"></Option>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="tagvalue">2</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Tag" comment="" direction="Outbound" disabled="False" id="id462EA8B230547" log="False" position="8">
             <Src neg="True">
               <ObjectRef ref="id43BBF1FD9745"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-HTTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id43BBF1FD9745"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="classify_str"/>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="classify_str"></Option>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="tagvalue">2</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id43EC876732486" log="False" position="9">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id43EC877332486"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -17715,13 +19911,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id43EC878C32486" log="False" position="10">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="True">
+            </Dst>
+            <Srv neg="True">
               <ServiceRef ref="id43EC877332486"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -17729,14 +19929,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id43EC879D32486" log="False" position="11">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id43EC877332486"/>
               <ServiceRef ref="tcp-HTTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -17744,14 +19948,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id43EC87C832486" log="False" position="12">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="True">
+            </Dst>
+            <Srv neg="True">
               <ServiceRef ref="id43EC877332486"/>
               <ServiceRef ref="tcp-HTTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -17759,13 +19967,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Pipe" direction="Both" disabled="False" id="id43BBF1C59745" log="False" position="13">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3D151943"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-HTTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -17775,13 +19987,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id43BBF1D19745" log="False" position="14">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -17789,79 +20005,82 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id43BBF1DD9745" log="True" position="15">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id43BBF1F99745" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="" dyn="False" id="id43BBF1FA9745" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.22" comment="" id="id43BBF1FC9745" name="firewall38:eth0:ip" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id43BBF1FD9745" label="eth1(outside)" mgmt="False" name="eth1" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="22.22.23.22" comment="" id="id43BBF1FF9745" name="firewall38:eth1:ip" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id43BBF2009745" label="eth2(dmz)" mgmt="False" name="eth2" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="192.168.2.1" comment="this interface is on the subnet that overlaps with eth1" id="id43BBF2029745" name="firewall38:eth2:ip" netmask="255.255.255.0"/>
+        </Policy>
+        <Routing id="id43BBF1F99745" name="Routing"/>
+        <Interface bridgeport="False" comment="" dyn="False" id="id43BBF1FA9745" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id43BBF1FC9745" name="firewall38:eth0:ip" address="192.168.1.22" netmask="255.255.255.0"/>
         </Interface>
-          <Management address="192.168.1.22">
+        <Interface bridgeport="False" comment="" dyn="False" id="id43BBF1FD9745" label="eth1(outside)" mgmt="False" name="eth1" security_level="0" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id43BBF1FF9745" name="firewall38:eth1:ip" address="22.22.23.22" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" comment="" dyn="False" id="id43BBF2009745" label="eth2(dmz)" mgmt="False" name="eth2" security_level="0" unnum="False" unprotected="False">
+          <IPv4 comment="this interface is on the subnet that overlaps with eth1" id="id43BBF2029745" name="firewall38:eth2:ip" address="192.168.2.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Management address="192.168.1.22">
           <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP host prohibited</Option>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
-          <Option name="epilog_script"/>
-          <Option name="firewall_dir"/>
+          <Option name="epilog_script"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">True</Option>
-          <Option name="limit_suffix"/>
+          <Option name="limit_suffix"></Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">True</Option>
           <Option name="local_nat">True</Option>
           <Option name="log_all">False</Option>
@@ -17873,16 +20092,16 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
-          <Option name="sshArgs"/>
+          <Option name="prolog_script"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -17891,22 +20110,25 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="&#10;This is BRIDGING FIREWALL&#10;Testing module physdev&#10;" host_OS="linux24" id="id440C055614846" lastCompiled="1188097043" lastInstalled="1142003872" lastModified="1163136879" name="firewall23-1" platform="iptables" ro="False" version="1.3.0">
-        <NAT id="id440C062B14846" name="NAT">
-          </NAT>
-          <Policy id="id440C055C14846" name="Policy">
+        <NAT id="id440C062B14846" name="NAT"/>
+        <Policy id="id440C055C14846" name="Policy">
           <PolicyRule action="Accept" direction="Inbound" disabled="False" id="id440C055D14846" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id440C055614846"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id440C062D14846"/>
               <ObjectRef ref="id440C063914846"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -17914,14 +20136,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="" direction="Inbound" disabled="False" id="id440C056914846" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id440C062D14846"/>
               <ObjectRef ref="id440C063914846"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -17929,14 +20155,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="" direction="Inbound" disabled="False" id="id45546A9B30629" log="True" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B4572AF"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id440C062D14846"/>
               <ObjectRef ref="id440C063914846"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -17944,14 +20174,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="testing for bug 1593221" direction="Inbound" disabled="False" id="id45546AAE30629" log="True" position="3">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B4572AF"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id440C062D14846"/>
               <ObjectRef ref="id440C063914846"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -17959,14 +20193,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" direction="Inbound" disabled="False" id="id440C057514846" log="False" position="4">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B64FFAC"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id440C062D14846"/>
               <ObjectRef ref="id440C063914846"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -17974,14 +20212,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="" direction="Inbound" disabled="False" id="id440C058114846" log="False" position="5">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3CFBE20C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id440C062D14846"/>
               <ObjectRef ref="id440C063914846"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -17989,14 +20231,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="" direction="Inbound" disabled="False" id="id440C058D14846" log="False" position="6">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3A84EECE"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id440C062D14846"/>
               <ObjectRef ref="id440C063914846"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -18004,14 +20250,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" direction="Inbound" disabled="False" id="id440C059914846" log="False" position="7">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id440C062D14846"/>
               <ObjectRef ref="id440C063914846"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -18019,14 +20269,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="" direction="Outbound" disabled="False" id="id440C065A14846" log="False" position="8">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id440C062D14846"/>
               <ObjectRef ref="id440C063914846"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -18034,14 +20288,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" comment="" direction="Inbound" disabled="False" id="id440C05A514846" log="False" position="9">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="True">
+            </Src>
+            <Dst neg="True">
               <ObjectRef ref="net-Internal_net"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id440C062D14846"/>
               <ObjectRef ref="id440C063914846"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -18051,85 +20309,101 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Classify" comment="" direction="Outbound" disabled="False" id="id440C2D7814846" log="False" position="10">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id440C062D14846"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="classify_str">1:12</Option>
-              <Option name="custom_str"/>
+              <Option name="custom_str"></Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
-              <Option name="tagvalue"/>
+              <Option name="tagvalue"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Classify" comment="" direction="Outbound" disabled="False" id="id440C2DA414846" log="False" position="11">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id440C063914846"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="classify_str">2:12</Option>
-              <Option name="custom_str"/>
+              <Option name="custom_str"></Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
-              <Option name="tagvalue"/>
+              <Option name="tagvalue"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Classify" comment="" direction="Outbound" disabled="False" id="id451CBF6532306" log="True" position="12">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id440C062D14846"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="classify_str">1:12</Option>
-              <Option name="custom_str"/>
+              <Option name="custom_str"></Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
-              <Option name="tagvalue"/>
+              <Option name="tagvalue"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id440C05B114846" log="False" position="13">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3CFBE20C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="udp-bootpc"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -18137,14 +20411,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id440C05BD14846" log="False" position="14">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B64FFAC"/>
               <ObjectRef ref="host-hostA"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="udp-bootpc"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -18152,14 +20430,18 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id440C05CA14846" log="False" position="15">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3A84EECE"/>
               <ObjectRef ref="host-hostB"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -18167,13 +20449,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id440C05D714846" log="False" position="16">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3D84EEC8"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -18181,13 +20467,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id440C05E314846" log="False" position="17">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="host-hostA"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-IRC"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -18195,13 +20485,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id440C05EF14846" log="True" position="18">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="host-hostA"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -18211,13 +20505,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="this rule should generate commands&#10;in both INPUT and FORWARD chains&#10;because this is a bridging firewall&#10;see bug #811860" direction="Both" disabled="False" id="id440C05FB14846" log="False" position="19">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id440C055614846"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-SSH"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -18225,13 +20523,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id440C060714846" log="False" position="20">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id440C055614846"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -18239,13 +20541,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="interface of another firewall&#10;(firewall11)&#10;Why do we need to test for this?&#10;" direction="Both" disabled="False" id="id440C061314846" log="False" position="21">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3F28B886"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -18253,74 +20559,78 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="testing processor checkForUnnumbered" direction="Both" disabled="True" id="id440C061F14846" log="False" position="22">
             <Src neg="False">
               <ObjectRef ref="id440C062D14846"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id440C062C14846" name="Routing">
-          </Routing>
-          <Interface bridgeport="True" comment="this interface is part of the bridge" dyn="False" id="id440C062D14846" label="" mgmt="False" name="eth2" security_level="100" unnum="False" unprotected="False"/><Interface bridgeport="False" dyn="False" id="id440C062E14846" name="lo" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="127.0.0.1" id="id440C063014846" name="firewall23-1:lo:ip" netmask="255.0.0.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id440C063114846" label="" mgmt="False" name="br0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.1" comment="" id="id440C063314846" name="firewall23-1:br0:ip" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="True" comment="" dyn="False" id="id440C063914846" label="" mgmt="False" name="eth3" security_level="100" unnum="False" unprotected="False"/>
-          <Management address="192.168.1.1">
+        </Policy>
+        <Routing id="id440C062C14846" name="Routing"/>
+        <Interface bridgeport="True" comment="this interface is part of the bridge" dyn="False" id="id440C062D14846" label="" mgmt="False" name="eth2" security_level="100" unnum="False" unprotected="False"/>
+        <Interface bridgeport="False" dyn="False" id="id440C062E14846" name="lo" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id440C063014846" name="firewall23-1:lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
+        </Interface>
+        <Interface bridgeport="False" comment="" dyn="False" id="id440C063114846" label="" mgmt="False" name="br0" security_level="100" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id440C063314846" name="firewall23-1:br0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="True" comment="" dyn="False" id="id440C063914846" label="" mgmt="False" name="eth3" security_level="100" unnum="False" unprotected="False"/>
+        <Management address="192.168.1.1">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
           <Option name="bridging_fw">True</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="dyn_addr">False</Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">False</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -18329,7 +20639,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
@@ -18337,10 +20647,10 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="no_optimisation">False</Option>
           <Option name="platform">iptables</Option>
           <Option name="proxy_arp">False</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -18349,7 +20659,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="testing branching rules&#10;&#10;normal script mode (not using  iptables-restore)" host_OS="linux24" id="id445DA2F330753" inactive="False" lastCompiled="1188097172" lastInstalled="1146967632" lastModified="1208753886" name="firewall39" platform="iptables" ro="False" version="">
         <NAT id="id445DA35A30753" name="NAT">
           <NATRule comment="" disabled="False" id="id445DA35B30753" position="0">
@@ -18373,25 +20683,30 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule></NAT>
-          <Policy id="id445DA2F930753" name="Policy">
+          </NATRule>
+        </NAT>
+        <Policy id="id445DA2F930753" name="Policy">
           <PolicyRule action="Branch" direction="Both" disabled="False" id="id445DA2FA30753" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="branch_name">rule0_branch</Option>
               <Option name="color">#C0BA44</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
               <Option name="tagvalue">16</Option>
             </PolicyRuleOptions>
@@ -18399,20 +20714,24 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Branch" comment="" direction="Both" disabled="False" id="id445DA30630753" log="True" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="branch_name">rule1_branch</Option>
               <Option name="color">#C0BA44</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
               <Option name="tagvalue">16</Option>
             </PolicyRuleOptions>
@@ -18420,20 +20739,24 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Branch" comment="" direction="Both" disabled="False" id="id445DA31230753" log="True" position="2">
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="branch_name">rule2_branch</Option>
               <Option name="color">#C0BA44</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
               <Option name="tagvalue">16</Option>
             </PolicyRuleOptions>
@@ -18441,20 +20764,24 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Branch" comment="" direction="Inbound" disabled="False" id="id445DA31E30753" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id445DA36E30753"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="branch_name">rule3_branch</Option>
               <Option name="color">#C0BA44</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
               <Option name="tagvalue">16</Option>
             </PolicyRuleOptions>
@@ -18462,40 +20789,44 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Branch" comment="" direction="Outbound" disabled="False" id="id464C589B3999" log="False" position="4">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id445DA36E30753"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="branch_name">rule3_branch</Option>
-              <Option name="classify_str"/>
+              <Option name="classify_str"></Option>
               <Option name="color">#C0BA44</Option>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_branch_in_mangle">False</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
               <Option name="tagvalue">16</Option>
             </PolicyRuleOptions>
@@ -18503,13 +20834,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Branch" direction="Both" disabled="False" id="id445DA32A30753" log="False" position="5">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3D151943"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-HTTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -18521,17 +20856,21 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Branch" direction="Both" disabled="False" id="id445DA33630753" log="False" position="6">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="branch_name">rule5_branch</Option>
               <Option name="classify_str">1:2</Option>
               <Option name="color">#C0BA44</Option>
@@ -18540,53 +20879,57 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="ipfw_pipe_method">0</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
-              <Option name="rule_name_accounting"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
-              <Option name="tagvalue"/>
+              <Option name="tagvalue"></Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Branch" comment="green rules branch &#10;also in mangle table" direction="Both" disabled="False" id="id464C29973999" log="False" position="7">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="branch_name">rule0_branch</Option>
-              <Option name="classify_str"/>
+              <Option name="classify_str"></Option>
               <Option name="color">#8BC065</Option>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_branch_in_mangle">True</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
               <Option name="tagvalue">16</Option>
             </PolicyRuleOptions>
@@ -18594,40 +20937,44 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Branch" comment="" direction="Both" disabled="False" id="id464C29A93999" log="True" position="8">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="branch_name">rule1_branch</Option>
-              <Option name="classify_str"/>
+              <Option name="classify_str"></Option>
               <Option name="color">#8BC065</Option>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_branch_in_mangle">True</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
               <Option name="tagvalue">16</Option>
             </PolicyRuleOptions>
@@ -18635,40 +20982,44 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Branch" comment="" direction="Both" disabled="False" id="id464C29BB3999" log="True" position="9">
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="branch_name">rule2_branch</Option>
-              <Option name="classify_str"/>
+              <Option name="classify_str"></Option>
               <Option name="color">#8BC065</Option>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_branch_in_mangle">True</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
               <Option name="tagvalue">16</Option>
             </PolicyRuleOptions>
@@ -18676,40 +21027,44 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Branch" comment="" direction="Inbound" disabled="False" id="id464C29CD3999" log="False" position="10">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id445DA36E30753"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="branch_name">rule3_branch</Option>
-              <Option name="classify_str"/>
+              <Option name="classify_str"></Option>
               <Option name="color">#8BC065</Option>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_branch_in_mangle">True</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
               <Option name="tagvalue">16</Option>
             </PolicyRuleOptions>
@@ -18717,40 +21072,44 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Branch" comment="" direction="Outbound" disabled="False" id="id464C58AD3999" log="False" position="11">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id445DA36E30753"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="branch_name">rule3_branch</Option>
-              <Option name="classify_str"/>
+              <Option name="classify_str"></Option>
               <Option name="color">#8BC065</Option>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_branch_in_mangle">True</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
               <Option name="tagvalue">16</Option>
             </PolicyRuleOptions>
@@ -18758,64 +21117,72 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Branch" comment="" direction="Both" disabled="False" id="id464C29DF3999" log="False" position="12">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3D151943"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-HTTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="branch_name">rule4_branch</Option>
-              <Option name="classify_str"/>
+              <Option name="classify_str"></Option>
               <Option name="color">#8BC065</Option>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_branch_in_mangle">True</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Branch" comment="" direction="Both" disabled="False" id="id464C29F13999" log="False" position="13">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="branch_name">rule5_branch</Option>
               <Option name="classify_str">1:2</Option>
               <Option name="color">#8BC065</Option>
               <Option name="custom_str">-j TCPMSS --set-mss 1400</Option>
               <Option name="firewall_is_part_of_any_and_networks">False</Option>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_method">0</Option>
@@ -18823,470 +21190,533 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_branch_in_mangle">True</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
-              <Option name="tagvalue"/>
+              <Option name="tagvalue"></Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Custom" comment="" direction="Both" disabled="False" id="id445DA34230753" log="False" position="14">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="classify_str"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="classify_str"></Option>
               <Option name="custom_str">-j TCPMSS --set-mss 1400</Option>
               <Option name="ipfw_pipe_method">0</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
-              <Option name="tagvalue"/>
+              <Option name="tagvalue"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Custom" direction="Both" disabled="False" id="id451DA7EF4163" log="True" position="15">
             <Src neg="False">
               <ObjectRef ref="id3CEBFCAE"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="classify_str"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="classify_str"></Option>
               <Option name="custom_str">-j TARPIT</Option>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">Route through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">Route through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id445DA34E30753" log="True" position="16">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          <Policy id="id45514D0E11228" name="rule_4_0_branch">
-            <PolicyRule action="Accept" direction="Outbound" disabled="False" id="id45514D0F11228" log="False" position="0">
+        </Policy>
+        <Policy id="id45514D0E11228" name="rule_4_0_branch">
+          <PolicyRule action="Accept" direction="Outbound" disabled="False" id="id45514D0F11228" log="False" position="0">
             <Src neg="False">
-                      <ObjectRef ref="sysid0"/>
-                    </Src><Dst neg="False">
-                      <ObjectRef ref="sysid0"/>
-                    </Dst><Srv neg="False">
-                      <ServiceRef ref="sysid1"/>
-                    </Srv><Itf neg="False">
-                      <ObjectRef ref="id445DA37130753"/>
-                    </Itf><When neg="False">
-                      <IntervalRef ref="sysid2"/>
-                    </When>
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="id445DA37130753"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
             <PolicyRuleOptions/>
           </PolicyRule>
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id45545B9C22651" log="True" position="1">
             <Src neg="False">
-                      <ObjectRef ref="sysid0"/>
-                    </Src><Dst neg="False">
-                      <ObjectRef ref="sysid0"/>
-                    </Dst><Srv neg="False">
-                      <ServiceRef ref="sysid1"/>
-                    </Srv><Itf neg="False">
-                      <ObjectRef ref="sysid0"/>
-                    </Itf><When neg="False">
-                      <IntervalRef ref="sysid2"/>
-                    </When>
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
             <PolicyRuleOptions>
-                      <Option name="stateless">True</Option>
-                    </PolicyRuleOptions>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          <Policy id="id4554876222651" name="rule_4_1_branch">
-            <PolicyRule action="Accept" comment="" direction="Outbound" disabled="False" id="id4554877422651" log="False" position="0">
+        </Policy>
+        <Policy id="id4554876222651" name="rule_4_1_branch">
+          <PolicyRule action="Accept" comment="" direction="Outbound" disabled="False" id="id4554877422651" log="False" position="0">
             <Src neg="False">
-                      <ObjectRef ref="sysid0"/>
-                    </Src><Dst neg="False">
-                      <ObjectRef ref="sysid0"/>
-                    </Dst><Srv neg="False">
-                      <ServiceRef ref="sysid1"/>
-                    </Srv><Itf neg="False">
-                      <ObjectRef ref="id445DA37130753"/>
-                    </Itf><When neg="False">
-                      <IntervalRef ref="sysid2"/>
-                    </When>
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="id445DA37130753"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
             <PolicyRuleOptions/>
           </PolicyRule>
           <PolicyRule action="Deny" comment="" direction="Both" disabled="False" id="id4554876322651" log="True" position="1">
             <Src neg="False">
-                      <ObjectRef ref="sysid0"/>
-                    </Src><Dst neg="False">
-                      <ObjectRef ref="sysid0"/>
-                    </Dst><Srv neg="False">
-                      <ServiceRef ref="sysid1"/>
-                    </Srv><Itf neg="False">
-                      <ObjectRef ref="sysid0"/>
-                    </Itf><When neg="False">
-                      <IntervalRef ref="sysid2"/>
-                    </When>
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
             <PolicyRuleOptions>
-                      <Option name="stateless">True</Option>
-                    </PolicyRuleOptions>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          <Policy id="id445DCB2A30753" name="rule0_branch">
-            <PolicyRule action="Accept" direction="Both" disabled="False" id="id445DCB3030753" log="True" position="0">
+        </Policy>
+        <Policy id="id445DCB2A30753" name="rule0_branch">
+          <PolicyRule action="Accept" direction="Both" disabled="False" id="id445DCB3030753" log="True" position="0">
             <Src neg="False">
-                  <ObjectRef ref="sysid0"/>
-                </Src><Dst neg="False">
-                  <ObjectRef ref="sysid0"/>
-                </Dst><Srv neg="False">
-                  <ServiceRef ref="sysid1"/>
-                </Srv><Itf neg="False">
-                  <ObjectRef ref="sysid0"/>
-                </Itf><When neg="False">
-                  <IntervalRef ref="sysid2"/>
-                </When>
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          </Policy>
-          <Policy id="id445DCB2B30753" name="rule1_branch">
-            <PolicyRule action="Deny" direction="Both" disabled="False" id="id445DCB3C30753" log="True" position="0">
+        </Policy>
+        <Policy id="id445DCB2B30753" name="rule1_branch">
+          <PolicyRule action="Deny" direction="Both" disabled="False" id="id445DCB3C30753" log="True" position="0">
             <Src neg="False">
-                  <ObjectRef ref="sysid0"/>
-                </Src><Dst neg="False">
-                  <ObjectRef ref="id3D151943"/>
-                </Dst><Srv neg="False">
-                  <ServiceRef ref="sysid1"/>
-                </Srv><Itf neg="False">
-                  <ObjectRef ref="sysid0"/>
-                </Itf><When neg="False">
-                  <IntervalRef ref="sysid2"/>
-                </When>
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="id3D151943"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
             <PolicyRuleOptions>
-                  <Option name="stateless">True</Option>
-                </PolicyRuleOptions>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id445DCB5230753" log="False" position="1">
             <Src neg="False">
-                  <ObjectRef ref="sysid0"/>
-                </Src><Dst neg="False">
-                  <ObjectRef ref="sysid0"/>
-                </Dst><Srv neg="False">
-                  <ServiceRef ref="sysid1"/>
-                </Srv><Itf neg="False">
-                  <ObjectRef ref="sysid0"/>
-                </Itf><When neg="False">
-                  <IntervalRef ref="sysid2"/>
-                </When>
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          </Policy>
-          <Policy id="id445DCB2C30753" name="rule2_branch">
-            <PolicyRule action="Deny" direction="Both" disabled="False" id="id445DF33930753" log="True" position="0">
+        </Policy>
+        <Policy id="id445DCB2C30753" name="rule2_branch">
+          <PolicyRule action="Deny" direction="Both" disabled="False" id="id445DF33930753" log="True" position="0">
             <Src neg="False">
-                  <ObjectRef ref="sysid0"/>
-                </Src><Dst neg="True">
-                  <ObjectRef ref="id3D151943"/>
-                </Dst><Srv neg="False">
-                  <ServiceRef ref="sysid1"/>
-                </Srv><Itf neg="False">
-                  <ObjectRef ref="sysid0"/>
-                </Itf><When neg="False">
-                  <IntervalRef ref="sysid2"/>
-                </When>
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="True">
+              <ObjectRef ref="id3D151943"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
             <PolicyRuleOptions>
-                  <Option name="stateless">True</Option>
-                </PolicyRuleOptions>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id445E431430753" log="False" position="1">
             <Src neg="False">
-                  <ObjectRef ref="id3CEBFCAE"/>
-                </Src><Dst neg="False">
-                  <ObjectRef ref="id3D151943"/>
-                </Dst><Srv neg="False">
-                  <ServiceRef ref="sysid1"/>
-                </Srv><Itf neg="False">
-                  <ObjectRef ref="sysid0"/>
-                </Itf><When neg="False">
-                  <IntervalRef ref="sysid2"/>
-                </When>
+              <ObjectRef ref="id3CEBFCAE"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="id3D151943"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
             <PolicyRuleOptions/>
           </PolicyRule>
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id445E432F30753" log="True" position="2">
             <Src neg="False">
-                  <ObjectRef ref="sysid0"/>
-                </Src><Dst neg="False">
-                  <ObjectRef ref="sysid0"/>
-                </Dst><Srv neg="False">
-                  <ServiceRef ref="sysid1"/>
-                </Srv><Itf neg="False">
-                  <ObjectRef ref="sysid0"/>
-                </Itf><When neg="False">
-                  <IntervalRef ref="sysid2"/>
-                </When>
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
             <PolicyRuleOptions>
-                  <Option name="stateless">True</Option>
-                </PolicyRuleOptions>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          <Policy id="id445DCB2D30753" name="rule3_branch">
-            <PolicyRule action="Accept" direction="Inbound" disabled="False" id="id445E6B3A30753" log="False" position="0">
+        </Policy>
+        <Policy id="id445DCB2D30753" name="rule3_branch">
+          <PolicyRule action="Accept" direction="Inbound" disabled="False" id="id445E6B3A30753" log="False" position="0">
             <Src neg="False">
-                  <ObjectRef ref="sysid0"/>
-                </Src><Dst neg="False">
-                  <ObjectRef ref="id445DA2F330753"/>
-                </Dst><Srv neg="False">
-                  <ServiceRef ref="sysid1"/>
-                </Srv><Itf neg="False">
-                  <ObjectRef ref="id445DA36E30753"/>
-                </Itf><When neg="False">
-                  <IntervalRef ref="sysid2"/>
-                </When>
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="id445DA2F330753"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="id445DA36E30753"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
             <PolicyRuleOptions/>
           </PolicyRule>
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id445E6B4730753" log="True" position="1">
             <Src neg="False">
-                  <ObjectRef ref="sysid0"/>
-                </Src><Dst neg="False">
-                  <ObjectRef ref="sysid0"/>
-                </Dst><Srv neg="False">
-                  <ServiceRef ref="sysid1"/>
-                </Srv><Itf neg="False">
-                  <ObjectRef ref="sysid0"/>
-                </Itf><When neg="False">
-                  <IntervalRef ref="sysid2"/>
-                </When>
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
             <PolicyRuleOptions>
-                  <Option name="stateless">True</Option>
-                </PolicyRuleOptions>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          <Policy id="id464C58AC3999" name="rule3_branch">
-            </Policy>
-          <Policy id="id445DCB2E30753" name="rule4_branch">
-            <PolicyRule action="Branch" direction="Inbound" disabled="False" id="id45514D0211228" log="True" position="0">
+        </Policy>
+        <Policy id="id464C58AC3999" name="rule3_branch"/>
+        <Policy id="id445DCB2E30753" name="rule4_branch">
+          <PolicyRule action="Branch" direction="Inbound" disabled="False" id="id45514D0211228" log="True" position="0">
             <Src neg="False">
-                  <ObjectRef ref="sysid0"/>
-                </Src><Dst neg="False">
-                  <ObjectRef ref="sysid0"/>
-                </Dst><Srv neg="False">
-                  <ServiceRef ref="sysid1"/>
-                </Srv><Itf neg="False">
-                  <ObjectRef ref="id445DA36E30753"/>
-                </Itf><When neg="False">
-                  <IntervalRef ref="sysid2"/>
-                </When>
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="id445DA36E30753"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
             <PolicyRuleOptions>
-                  <Option name="action_on_reject"/>
-                  <Option name="branch_name">rule_4_0_branch</Option>
-                  <Option name="classify_str"/>
-                  <Option name="custom_str"/>
-                  <Option name="ipf_route_opt_addr"/>
-                  <Option name="ipf_route_opt_if"/>
-                  <Option name="ipf_route_option">route_through</Option>
-                  <Option name="ipfw_classify_method">2</Option>
-                  <Option name="ipfw_pipe_port_num">0</Option>
-                  <Option name="ipfw_pipe_queue_num">0</Option>
-                  <Option name="ipt_branch_in_mangle">False</Option>
-                  <Option name="ipt_continue">False</Option>
-                  <Option name="ipt_gw"/>
-                  <Option name="ipt_iif"/>
-                  <Option name="ipt_mark_connections">False</Option>
-                  <Option name="ipt_mark_prerouting">False</Option>
-                  <Option name="ipt_oif"/>
-                  <Option name="ipt_tee">False</Option>
-                  <Option name="pf_fastroute">False</Option>
-                  <Option name="pf_route_opt_addr"/>
-                  <Option name="pf_route_opt_if"/>
-                  <Option name="pf_route_option">route_through</Option>
-                  <Option name="rule_name_accounting"/>
-                  <Option name="stateless">True</Option>
-                </PolicyRuleOptions>
+              <Option name="action_on_reject"></Option>
+              <Option name="branch_name">rule_4_0_branch</Option>
+              <Option name="classify_str"></Option>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
+              <Option name="ipf_route_option">route_through</Option>
+              <Option name="ipfw_classify_method">2</Option>
+              <Option name="ipfw_pipe_port_num">0</Option>
+              <Option name="ipfw_pipe_queue_num">0</Option>
+              <Option name="ipt_branch_in_mangle">False</Option>
+              <Option name="ipt_continue">False</Option>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
+              <Option name="ipt_mark_connections">False</Option>
+              <Option name="ipt_mark_prerouting">False</Option>
+              <Option name="ipt_oif"></Option>
+              <Option name="ipt_tee">False</Option>
+              <Option name="pf_fastroute">False</Option>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
+              <Option name="pf_route_option">route_through</Option>
+              <Option name="rule_name_accounting"></Option>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Branch" direction="Inbound" disabled="False" id="id4554875522651" log="True" position="1">
             <Src neg="False">
-                  <ObjectRef ref="sysid0"/>
-                </Src><Dst neg="False">
-                  <ObjectRef ref="sysid0"/>
-                </Dst><Srv neg="False">
-                  <ServiceRef ref="sysid1"/>
-                </Srv><Itf neg="False">
-                  <ObjectRef ref="id445DA36B30753"/>
-                </Itf><When neg="False">
-                  <IntervalRef ref="sysid2"/>
-                </When>
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="id445DA36B30753"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
             <PolicyRuleOptions>
-                  <Option name="action_on_reject"/>
-                  <Option name="branch_name">rule_4_1_branch</Option>
-                  <Option name="classify_str"/>
-                  <Option name="custom_str"/>
-                  <Option name="ipf_route_opt_addr"/>
-                  <Option name="ipf_route_opt_if"/>
-                  <Option name="ipf_route_option">route_through</Option>
-                  <Option name="ipfw_classify_method">2</Option>
-                  <Option name="ipfw_pipe_port_num">0</Option>
-                  <Option name="ipfw_pipe_queue_num">0</Option>
-                  <Option name="ipt_branch_in_mangle">False</Option>
-                  <Option name="ipt_continue">False</Option>
-                  <Option name="ipt_gw"/>
-                  <Option name="ipt_iif"/>
-                  <Option name="ipt_mark_connections">False</Option>
-                  <Option name="ipt_mark_prerouting">False</Option>
-                  <Option name="ipt_oif"/>
-                  <Option name="ipt_tee">False</Option>
-                  <Option name="pf_fastroute">False</Option>
-                  <Option name="pf_route_opt_addr"/>
-                  <Option name="pf_route_opt_if"/>
-                  <Option name="pf_route_option">route_through</Option>
-                  <Option name="rule_name_accounting"/>
-                  <Option name="stateless">True</Option>
-                </PolicyRuleOptions>
+              <Option name="action_on_reject"></Option>
+              <Option name="branch_name">rule_4_1_branch</Option>
+              <Option name="classify_str"></Option>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
+              <Option name="ipf_route_option">route_through</Option>
+              <Option name="ipfw_classify_method">2</Option>
+              <Option name="ipfw_pipe_port_num">0</Option>
+              <Option name="ipfw_pipe_queue_num">0</Option>
+              <Option name="ipt_branch_in_mangle">False</Option>
+              <Option name="ipt_continue">False</Option>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
+              <Option name="ipt_mark_connections">False</Option>
+              <Option name="ipt_mark_prerouting">False</Option>
+              <Option name="ipt_oif"></Option>
+              <Option name="ipt_tee">False</Option>
+              <Option name="pf_fastroute">False</Option>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
+              <Option name="pf_route_option">route_through</Option>
+              <Option name="rule_name_accounting"></Option>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          <Policy id="id445DCB2F30753" name="rule5_branch">
-            <PolicyRule action="Deny" direction="Both" disabled="True" id="id459651137309" log="True" position="0">
+        </Policy>
+        <Policy id="id445DCB2F30753" name="rule5_branch">
+          <PolicyRule action="Deny" direction="Both" disabled="True" id="id459651137309" log="True" position="0">
             <Src neg="False">
-                  <ObjectRef ref="sysid0"/>
-                </Src><Dst neg="False">
-                  <ObjectRef ref="sysid0"/>
-                </Dst><Srv neg="False">
-                  <ServiceRef ref="sysid1"/>
-                </Srv><Itf neg="False">
-                  <ObjectRef ref="sysid0"/>
-                </Itf><When neg="False">
-                  <IntervalRef ref="sysid2"/>
-                </When>
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
             <PolicyRuleOptions>
-                  <Option name="stateless">True</Option>
-                </PolicyRuleOptions>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          <Policy id="id464C29A83999" name="rule0_branch">
-            </Policy>
-          <Policy id="id464C29BA3999" name="rule1_branch">
-            </Policy>
-          <Policy id="id464C29CC3999" name="rule2_branch">
-            </Policy>
-          <Policy id="id464C29DE3999" name="rule3_branch">
-            </Policy>
-          <Policy id="id464C58BE3999" name="rule3_branch">
-            </Policy>
-          <Policy id="id464C29F03999" name="rule4_branch">
-            </Policy>
-          <Policy id="id464C2A023999" name="rule5_branch">
-            </Policy>
-          
-          <Routing id="id445DA36A30753" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="" dyn="False" id="id445DA36B30753" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.22" comment="" id="id445DA36D30753" name="firewall39:eth0:ip" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id445DA36E30753" label="eth1(outside)" mgmt="False" name="eth1" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="22.22.23.22" comment="" id="id445DA37030753" name="firewall39:eth1:ip" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id445DA37130753" label="eth2(dmz)" mgmt="False" name="eth2" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="192.168.2.1" comment="this interface is on the subnet that overlaps with eth1" id="id445DA37330753" name="firewall39:eth2:ip" netmask="255.255.255.0"/>
+        </Policy>
+        <Policy id="id464C29A83999" name="rule0_branch"/>
+        <Policy id="id464C29BA3999" name="rule1_branch"/>
+        <Policy id="id464C29CC3999" name="rule2_branch"/>
+        <Policy id="id464C29DE3999" name="rule3_branch"/>
+        <Policy id="id464C58BE3999" name="rule3_branch"/>
+        <Policy id="id464C29F03999" name="rule4_branch"/>
+        <Policy id="id464C2A023999" name="rule5_branch"/>
+        <Routing id="id445DA36A30753" name="Routing"/>
+        <Interface bridgeport="False" comment="" dyn="False" id="id445DA36B30753" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id445DA36D30753" name="firewall39:eth0:ip" address="192.168.1.22" netmask="255.255.255.0"/>
         </Interface>
-          <Management address="192.168.1.22">
+        <Interface bridgeport="False" comment="" dyn="False" id="id445DA36E30753" label="eth1(outside)" mgmt="False" name="eth1" security_level="0" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id445DA37030753" name="firewall39:eth1:ip" address="22.22.23.22" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" comment="" dyn="False" id="id445DA37130753" label="eth2(dmz)" mgmt="False" name="eth2" security_level="0" unnum="False" unprotected="False">
+          <IPv4 comment="this interface is on the subnet that overlaps with eth1" id="id445DA37330753" name="firewall39:eth2:ip" address="192.168.2.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Management address="192.168.1.22">
           <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP host prohibited</Option>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">True</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="classify_mark_terminating">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
-          <Option name="epilog_script"/>
-          <Option name="firewall_dir"/>
+          <Option name="epilog_script"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">True</Option>
-          <Option name="limit_suffix"/>
+          <Option name="limit_suffix"></Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">True</Option>
           <Option name="local_nat">True</Option>
           <Option name="log_all">False</Option>
@@ -19298,17 +21728,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="no_ipv6_default_policy">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
-          <Option name="sshArgs"/>
+          <Option name="prolog_script"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -19317,7 +21747,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="&#10;more complex and realistic combination of Tag and Route rules&#10;" host_OS="linux24" id="id4492FED324380" inactive="False" lastCompiled="1188097187" lastInstalled="1142003872" lastModified="1150347460" name="firewall40" platform="iptables" ro="False" version="">
         <NAT id="id4492FF2E24380" name="NAT">
           <NATRule comment="Translate source address&#10;for outgoing connections" disabled="False" id="id4492FF2F24380" position="0">
@@ -19340,94 +21770,107 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule></NAT>
-          <Policy id="id4492FED924380" name="Policy">
+          </NATRule>
+        </NAT>
+        <Policy id="id4492FED924380" name="Policy">
           <PolicyRule action="Tag" direction="Inbound" disabled="False" id="id449328B224380" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id4492FF4E24380"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="branch_anchor_name"/>
-              <Option name="branch_chain_name"/>
-              <Option name="classify_str"/>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="branch_anchor_name"></Option>
+              <Option name="branch_chain_name"></Option>
+              <Option name="classify_str"></Option>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">Route through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">True</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">Route through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="tagvalue">1</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Tag" direction="Inbound" disabled="False" id="id449328BF24380" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id4492FF5724380"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="branch_anchor_name"/>
-              <Option name="branch_chain_name"/>
-              <Option name="classify_str"/>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="branch_anchor_name"></Option>
+              <Option name="branch_chain_name"></Option>
+              <Option name="classify_str"></Option>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">Route through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">True</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">Route through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="tagvalue">2</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Accept" comment="This permits access from internal net&#10;to the Internet and DMZ" direction="Both" disabled="False" id="id4492FEDA24380" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE7-1"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -19435,137 +21878,149 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Route" direction="Both" disabled="False" id="id449328CC24380" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id449328D824380"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="branch_anchor_name"/>
-              <Option name="branch_chain_name"/>
-              <Option name="classify_str"/>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="branch_anchor_name"></Option>
+              <Option name="branch_chain_name"></Option>
+              <Option name="classify_str"></Option>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">Route through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">True</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_oif">eth0</Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">Route through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Route" direction="Both" disabled="False" id="id449328DB24380" log="False" position="4">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id449328D924380"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="branch_anchor_name"/>
-              <Option name="branch_chain_name"/>
-              <Option name="classify_str"/>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="branch_anchor_name"></Option>
+              <Option name="branch_chain_name"></Option>
+              <Option name="classify_str"></Option>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">Route through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">True</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_oif">eth2</Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">Route through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id4492FF2224380" log="True" position="5">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id4492FF3D24380" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="" dyn="False" id="id4492FF4E24380" label="" mgmt="False" name="eth0" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="192.0.2.1" comment="This is a test address, change it to your real one" id="id4492FF5024380" name="firewall40:eth0:ip" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id4492FF5424380" label="loopback" mgmt="False" name="lo" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="127.0.0.1" comment="" id="id4492FF5624380" name="firewall40:lo:ip" netmask="255.0.0.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id4492FF5724380" label="" mgmt="False" name="eth2" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="192.0.100.1" comment="" id="id4492FF5924380" name="firewall40:eth2:ip" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id4492FF6024380" label="" mgmt="True" name="eth1" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.1" comment="" id="id4492FF6124380" name="firewall40:eth1:ip" netmask="255.255.255.0"/>
+        </Policy>
+        <Routing id="id4492FF3D24380" name="Routing"/>
+        <Interface bridgeport="False" comment="" dyn="False" id="id4492FF4E24380" label="" mgmt="False" name="eth0" security_level="0" unnum="False" unprotected="False">
+          <IPv4 comment="This is a test address, change it to your real one" id="id4492FF5024380" name="firewall40:eth0:ip" address="192.0.2.1" netmask="255.255.255.0"/>
         </Interface>
-          <Management address="192.168.1.1">
+        <Interface bridgeport="False" comment="" dyn="False" id="id4492FF5424380" label="loopback" mgmt="False" name="lo" security_level="100" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id4492FF5624380" name="firewall40:lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
+        </Interface>
+        <Interface bridgeport="False" comment="" dyn="False" id="id4492FF5724380" label="" mgmt="False" name="eth2" security_level="0" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id4492FF5924380" name="firewall40:eth2:ip" address="192.0.100.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" comment="" dyn="False" id="id4492FF6024380" label="" mgmt="True" name="eth1" security_level="100" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id4492FF6124380" name="firewall40:eth1:ip" address="192.168.1.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Management address="192.168.1.1">
           <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
           <FWBDManagement enabled="False" identity="" port="-1"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
-          <Option name="action_on_reject"/>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="action_on_reject"></Option>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="eliminate_duplicates">true</Option>
-          <Option name="epilog_script"/>
+          <Option name="epilog_script"></Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="freebsd_ip_forward">1</Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="in_out_code">true</Option>
-          <Option name="limit_suffix"/>
+          <Option name="limit_suffix"></Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">1</Option>
           <Option name="load_modules">True</Option>
@@ -19580,10 +22035,10 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="loopback_interface">lo0</Option>
           <Option name="macosx_ip_forward">1</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">false</Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
@@ -19603,11 +22058,11 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="pix_syslog_device_id_supported">false</Option>
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"/>
+          <Option name="prolog_script"></Option>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -19616,21 +22071,24 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">True</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="testing rule shadowing with run-time objects, rules with such objects should be ignored&#10;&#10;" host_OS="linux24" id="id44EC18128791" inactive="False" lastCompiled="1188097194" lastInstalled="0" lastModified="1168820241" name="firewall41" platform="iptables" ro="False" version="">
-        <NAT id="id44EC18168791" name="NAT">
-          </NAT>
-          <Policy id="id44EC18158791" name="Policy">
+        <NAT id="id44EC18168791" name="NAT"/>
+        <Policy id="id44EC18158791" name="Policy">
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id44EC181E8791" log="True" position="0">
             <Src neg="False">
               <ObjectRef ref="id44EC18128791"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id44EC181D8791"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -19638,13 +22096,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id44F7056428576" log="True" position="1">
             <Src neg="False">
               <ObjectRef ref="id44EC18128791"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id44F7056328576"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -19652,33 +22114,35 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id44F707E428576" log="True" position="2">
             <Src neg="False">
               <ObjectRef ref="id44EC18128791"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id44F7082928576"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id44EC18178791" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" dyn="False" id="id44EC18188791" label="ext" name="eth0" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="1.1.1.1" id="id44EC18198791" name="firewall41:eth0:ip" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id44EC181A8791" label="int" name="eth1" security_level="50" unnum="False" unprotected="False">
-          <IPv4 address="2.2.2.2" id="id44EC181B8791" name="firewall41:eth1:ip" netmask="255.255.255.0"/>
+        </Policy>
+        <Routing id="id44EC18178791" name="Routing"/>
+        <Interface bridgeport="False" dyn="False" id="id44EC18188791" label="ext" name="eth0" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id44EC18198791" name="firewall41:eth0:ip" address="1.1.1.1" netmask="255.255.255.0"/>
         </Interface>
-          <Management address="0.0.0.0">
+        <Interface bridgeport="False" dyn="False" id="id44EC181A8791" label="int" name="eth1" security_level="50" unnum="False" unprotected="False">
+          <IPv4 id="id44EC181B8791" name="firewall41:eth1:ip" address="2.2.2.2" netmask="255.255.255.0"/>
+        </Interface>
+        <Management address="0.0.0.0">
           <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
           <FWBDManagement enabled="False" identity="" port="-1"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">true</Option>
           <Option name="accept_new_tcp_with_no_syn">true</Option>
           <Option name="check_shading">true</Option>
@@ -19722,21 +22186,24 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="ulog_nlgroup">1</Option>
           <Option name="verify_interfaces">true</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="testing shadowing detection&#10;compiler runs with -xt flag&#10;firewall is assumed to be part of any" host_OS="linux24" id="id4513DEA62143" inactive="False" lastCompiled="1188097253" lastInstalled="0" lastModified="1158818614" name="test-shadowing-1" platform="iptables" ro="False" version="">
-        <NAT id="id4513DEAA2143" name="NAT">
-          </NAT>
-          <Policy id="id4513DEA92143" name="Policy">
+        <NAT id="id4513DEAA2143" name="NAT"/>
+        <Policy id="id4513DEA92143" name="Policy">
           <PolicyRule action="Accept" comment="shades rule below" direction="Outbound" disabled="False" id="id4513DECC2143" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id4513DEAC2143"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -19744,13 +22211,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" direction="Outbound" disabled="False" id="id4513DEC02143" log="True" position="1">
             <Src neg="False">
               <ObjectRef ref="host-hostA"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id4513DEAC2143"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -19760,13 +22231,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="firewall is part&#10;of any for this rule" direction="Both" disabled="False" id="id4514B3F72143" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-HTTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -19776,13 +22251,13 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="hashlimit_burst">0</Option>
               <Option name="hashlimit_dstlimit">False</Option>
               <Option name="hashlimit_mode">dstip</Option>
-              <Option name="hashlimit_suffix"/>
+              <Option name="hashlimit_suffix"></Option>
               <Option name="hashlimit_value">0</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">False</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
@@ -19790,13 +22265,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" comment="" direction="Both" disabled="False" id="id4514B3E62143" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="id451488C42143"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-HTTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -19806,13 +22285,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="this rule should shadow rule below it because&#10;it uses IPService object with protocol 0" disabled="False" id="id451509E52143" log="False" position="4">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id419D6869"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -19820,13 +22303,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" comment="" disabled="False" id="id451509D42143" log="True" position="5">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-IRC"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -19836,13 +22323,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id451488B82143" log="True" position="6">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -19852,13 +22343,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id4513DEB42143" log="True" position="7">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -19868,59 +22363,62 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id4513DEDA2143" log="True" position="8">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id4513DEAB2143" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" dyn="False" id="id4513DEAC2143" label="" name="eth0" security_level="50" unnum="False" unprotected="False">
-          <IPv4 address="22.22.22.22" id="id4513DEAD2143" name="test-shadowing-1:eth0:ip" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id4513DEAE2143" label="" name="eth1" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.1" id="id4513DEAF2143" name="test-shadowing-1:eth1:ip" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id4513DEB02143" label="" name="eth2" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.2.1" id="id4513DEB12143" name="test-shadowing-1:eth2:ip" netmask="255.255.255.0"/>
+        </Policy>
+        <Routing id="id4513DEAB2143" name="Routing"/>
+        <Interface bridgeport="False" dyn="False" id="id4513DEAC2143" label="" name="eth0" security_level="50" unnum="False" unprotected="False">
+          <IPv4 id="id4513DEAD2143" name="test-shadowing-1:eth0:ip" address="22.22.22.22" netmask="255.255.255.0"/>
         </Interface>
-          <Management address="192.168.2.1">
+        <Interface bridgeport="False" dyn="False" id="id4513DEAE2143" label="" name="eth1" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id4513DEAF2143" name="test-shadowing-1:eth1:ip" address="192.168.1.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" dyn="False" id="id4513DEB02143" label="" name="eth2" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id4513DEB12143" name="test-shadowing-1:eth2:ip" address="192.168.2.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Management address="192.168.2.1">
           <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
           <FWBDManagement enabled="False" identity="" port="-1"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
-          <Option name="action_on_reject"/>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="action_on_reject"></Option>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">True</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="cmdline">-xt</Option>
-          <Option name="compiler"/>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="eliminate_duplicates">true</Option>
-          <Option name="epilog_script"/>
+          <Option name="epilog_script"></Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="freebsd_ip_forward">1</Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="in_out_code">true</Option>
-          <Option name="limit_suffix"/>
+          <Option name="limit_suffix"></Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">1</Option>
           <Option name="load_modules">True</Option>
@@ -19935,10 +22433,10 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="loopback_interface">lo0</Option>
           <Option name="macosx_ip_forward">1</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">false</Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
@@ -19958,11 +22456,11 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="pix_syslog_device_id_supported">false</Option>
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"/>
+          <Option name="prolog_script"></Option>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -19971,21 +22469,24 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">True</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="testing shadowing detection&#10;compiler runs with -xt flag&#10;firewall is NOT assumed to be part of any" host_OS="linux24" id="id451488C42143" inactive="False" lastCompiled="1188097259" lastInstalled="0" lastModified="1158818614" name="test-shadowing-2" platform="iptables" ro="False" version="">
-        <NAT id="id451489072143" name="NAT">
-          </NAT>
-          <Policy id="id451488CA2143" name="Policy">
+        <NAT id="id451489072143" name="NAT"/>
+        <Policy id="id451488CA2143" name="Policy">
           <PolicyRule action="Accept" comment="shades rule below" direction="Outbound" disabled="False" id="id451488CB2143" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id451489092143"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -19993,13 +22494,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" direction="Outbound" disabled="False" id="id451488D72143" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="host-hostA"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id451489092143"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -20009,13 +22514,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="firewall is part&#10;of any for this rule" direction="Both" disabled="False" id="id451488E32143" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-HTTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -20025,13 +22534,13 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="hashlimit_burst">0</Option>
               <Option name="hashlimit_dstlimit">False</Option>
               <Option name="hashlimit_mode">dstip</Option>
-              <Option name="hashlimit_suffix"/>
+              <Option name="hashlimit_suffix"></Option>
               <Option name="hashlimit_value">0</Option>
               <Option name="limit_burst">0</Option>
-              <Option name="limit_suffix"/>
+              <Option name="limit_suffix"></Option>
               <Option name="limit_value">0</Option>
-              <Option name="log_level"/>
-              <Option name="log_prefix"/>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
               <Option name="stateless">False</Option>
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
@@ -20039,13 +22548,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id451488EF2143" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="id451488C42143"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-HTTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -20055,13 +22568,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="this rule should shadow rule below it because&#10;it uses IPService object with protocol 0" disabled="False" id="id45150A072143" log="False" position="4">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id419D6869"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -20069,13 +22586,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" comment="" disabled="False" id="id451509F62143" log="True" position="5">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-IRC"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -20085,59 +22606,62 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id451488FB2143" log="True" position="6">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id451489082143" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" dyn="False" id="id451489092143" label="" name="eth0" security_level="50" unnum="False" unprotected="False">
-          <IPv4 address="22.22.22.22" id="id4514890B2143" name="test-shadowing-2:eth0:ip" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id4514890C2143" label="" name="eth1" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.1" id="id4514890E2143" name="test-shadowing-2:eth1:ip" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id4514890F2143" label="" name="eth2" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.2.1" id="id451489112143" name="test-shadowing-2:eth2:ip" netmask="255.255.255.0"/>
+        </Policy>
+        <Routing id="id451489082143" name="Routing"/>
+        <Interface bridgeport="False" dyn="False" id="id451489092143" label="" name="eth0" security_level="50" unnum="False" unprotected="False">
+          <IPv4 id="id4514890B2143" name="test-shadowing-2:eth0:ip" address="22.22.22.22" netmask="255.255.255.0"/>
         </Interface>
-          <Management address="192.168.2.1">
+        <Interface bridgeport="False" dyn="False" id="id4514890C2143" label="" name="eth1" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id4514890E2143" name="test-shadowing-2:eth1:ip" address="192.168.1.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" dyn="False" id="id4514890F2143" label="" name="eth2" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id451489112143" name="test-shadowing-2:eth2:ip" address="192.168.2.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Management address="192.168.2.1">
           <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
           <FWBDManagement enabled="False" identity="" port="-1"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
-          <Option name="action_on_reject"/>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="action_on_reject"></Option>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">True</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="cmdline">-xt</Option>
-          <Option name="compiler"/>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="eliminate_duplicates">true</Option>
-          <Option name="epilog_script"/>
+          <Option name="epilog_script"></Option>
           <Option name="firewall_dir">/etc</Option>
           <Option name="firewall_is_part_of_any_and_networks">False</Option>
           <Option name="freebsd_ip_forward">1</Option>
           <Option name="ignore_empty_groups">False</Option>
           <Option name="in_out_code">true</Option>
-          <Option name="limit_suffix"/>
+          <Option name="limit_suffix"></Option>
           <Option name="limit_value">0</Option>
           <Option name="linux24_ip_forward">1</Option>
           <Option name="load_modules">True</Option>
@@ -20152,10 +22676,10 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="loopback_interface">lo0</Option>
           <Option name="macosx_ip_forward">1</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="openbsd_ip_forward">1</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="pass_all_out">false</Option>
           <Option name="pf_limit_frags">5000</Option>
           <Option name="pf_limit_states">10000</Option>
@@ -20175,11 +22699,11 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="pix_syslog_device_id_supported">false</Option>
           <Option name="pix_use_acl_remarks">true</Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"/>
+          <Option name="prolog_script"></Option>
           <Option name="prompt1">$ </Option>
           <Option name="prompt2"> # </Option>
           <Option name="solaris_ip_forward">1</Option>
-          <Option name="sshArgs"/>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -20188,7 +22712,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">True</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="testing TAG and CLASSIFY rules&#10;&#10;same as firewall37 except rules are made to be terminating" host_OS="linux24" id="id45AB5A2C25451" inactive="False" lastCompiled="1188097157" lastInstalled="1142003872" lastModified="1178579501" name="firewall37-1" platform="iptables" ro="False" version="">
         <NAT id="id45AB5C5225451" name="NAT">
           <NATRule comment="" disabled="False" id="id45AB5C5325451" position="0">
@@ -20212,44 +22736,49 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <ServiceRef ref="sysid1"/>
             </TSrv>
             <NATRuleOptions/>
-          </NATRule></NAT>
-          <Policy id="id45AB5A3225451" name="Policy">
+          </NATRule>
+        </NAT>
+        <Policy id="id45AB5A3225451" name="Policy">
           <PolicyRule action="Tag" comment="terminating target" direction="Both" disabled="False" id="id45AB5AAD25451" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="classify_str"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="classify_str"></Option>
               <Option name="classify_terminating_target">False</Option>
               <Option name="color">#C0BA44</Option>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="tag_terminating_target">True</Option>
               <Option name="tagvalue">16</Option>
             </PolicyRuleOptions>
@@ -20257,39 +22786,43 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Tag" comment="terminating target" direction="Both" disabled="False" id="id45AB5AB925451" log="True" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="classify_str"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="classify_str"></Option>
               <Option name="classify_terminating_target">False</Option>
               <Option name="color">#C0BA44</Option>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="tag_terminating_target">True</Option>
               <Option name="tagvalue">16</Option>
             </PolicyRuleOptions>
@@ -20298,39 +22831,43 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="classify_str"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="classify_str"></Option>
               <Option name="classify_terminating_target">False</Option>
               <Option name="color">#C0BA44</Option>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="tag_terminating_target">True</Option>
               <Option name="tagvalue">16</Option>
             </PolicyRuleOptions>
@@ -20338,39 +22875,43 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Tag" comment="terminating target" direction="Inbound" disabled="False" id="id45AB5AD225451" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id45AB5C6625451"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="classify_str"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="classify_str"></Option>
               <Option name="classify_terminating_target">False</Option>
               <Option name="color">#C0BA44</Option>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="tag_terminating_target">True</Option>
               <Option name="tagvalue">16</Option>
             </PolicyRuleOptions>
@@ -20378,39 +22919,43 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Tag" comment="temrinating target" direction="Outbound" disabled="False" id="id45AB5ADE25451" log="False" position="4">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id45AB5C6625451"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="classify_str"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="classify_str"></Option>
               <Option name="classify_terminating_target">False</Option>
               <Option name="color">#C0BA44</Option>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="tag_terminating_target">True</Option>
               <Option name="tagvalue">16</Option>
             </PolicyRuleOptions>
@@ -20418,39 +22963,43 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Tag" comment="terminating and CONNMARK" direction="Both" disabled="False" id="id45AB5AEA25451" log="False" position="5">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="classify_str"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="classify_str"></Option>
               <Option name="classify_terminating_target">False</Option>
               <Option name="color">#C0C0C0</Option>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">True</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="tag_terminating_target">True</Option>
               <Option name="tagvalue">10</Option>
             </PolicyRuleOptions>
@@ -20458,39 +23007,43 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Tag" comment="terminating and CONNMARK" direction="Both" disabled="False" id="id45AB5AF625451" log="True" position="6">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="classify_str"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="classify_str"></Option>
               <Option name="classify_terminating_target">False</Option>
               <Option name="color">#C0C0C0</Option>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">True</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="tag_terminating_target">True</Option>
               <Option name="tagvalue">10</Option>
             </PolicyRuleOptions>
@@ -20499,39 +23052,43 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="classify_str"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="classify_str"></Option>
               <Option name="classify_terminating_target">False</Option>
               <Option name="color">#C0C0C0</Option>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">True</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="tag_terminating_target">True</Option>
               <Option name="tagvalue">10</Option>
             </PolicyRuleOptions>
@@ -20539,39 +23096,43 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Tag" comment="terminating and CONNMARK" direction="Inbound" disabled="False" id="id45AB5B0F25451" log="False" position="8">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id45AB5C6625451"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="classify_str"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="classify_str"></Option>
               <Option name="classify_terminating_target">False</Option>
               <Option name="color">#C0C0C0</Option>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">True</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="tag_terminating_target">True</Option>
               <Option name="tagvalue">10</Option>
             </PolicyRuleOptions>
@@ -20579,39 +23140,43 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Tag" comment="terminating and CONNMARK" direction="Outbound" disabled="False" id="id45AB5B1B25451" log="False" position="9">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id3CB1279B"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id45AB5C6625451"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="classify_str"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="classify_str"></Option>
               <Option name="classify_terminating_target">False</Option>
               <Option name="color">#C0C0C0</Option>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">True</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="tag_terminating_target">True</Option>
               <Option name="tagvalue">10</Option>
             </PolicyRuleOptions>
@@ -20619,13 +23184,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Pipe" direction="Both" disabled="False" id="id45AB5B2725451" log="False" position="10">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3D151943"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-HTTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -20635,39 +23204,43 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Classify" comment="testing for bug #1618381&#10;this rule, and the next one, should place&#10;CLASSIFY rule in a separate chain&#10;and pass control to it using -g" direction="Both" disabled="False" id="id45AB5B9525451" log="False" position="11">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="icmp-Unreachables"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="classify_str">1:10</Option>
               <Option name="classify_terminating_target">True</Option>
               <Option name="color">#C0BA44</Option>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
               <Option name="tag_terminating_target">False</Option>
             </PolicyRuleOptions>
@@ -20675,39 +23248,43 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Classify" comment="second rule for bug #1618381" direction="Both" disabled="False" id="id45AB5BA125451" log="False" position="12">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id45AB5C6325451"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="classify_str">1:11</Option>
               <Option name="classify_terminating_target">True</Option>
               <Option name="color">#C0BA44</Option>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
               <Option name="tag_terminating_target">False</Option>
             </PolicyRuleOptions>
@@ -20716,39 +23293,43 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="icmp-Unreachables"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="classify_str">1:10</Option>
               <Option name="classify_terminating_target">True</Option>
               <Option name="color">#C0BA44</Option>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
               <Option name="tag_terminating_target">False</Option>
             </PolicyRuleOptions>
@@ -20757,40 +23338,44 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="icmp-Unreachables"/>
               <ServiceRef ref="tcp-HTTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="classify_str">1:10</Option>
               <Option name="classify_terminating_target">True</Option>
               <Option name="color">#C0BA44</Option>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
               <Option name="tag_terminating_target">False</Option>
             </PolicyRuleOptions>
@@ -20798,40 +23383,44 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Classify" comment="bug #1618381&#10;this rule uses multiport&#10;and has to be split because&#10;of that" direction="Both" disabled="False" id="id45AB5BC825451" log="False" position="15">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id41D0F023"/>
               <ServiceRef ref="id3D4DE626"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id45AB5C6325451"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="classify_str">1:11</Option>
               <Option name="classify_terminating_target">True</Option>
               <Option name="color">#C0BA44</Option>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
               <Option name="tag_terminating_target">False</Option>
             </PolicyRuleOptions>
@@ -20839,117 +23428,129 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Classify" comment="testing for bug #1618381&#10;this rule, and the next one, should place&#10;CLASSIFY rule in a separate chain&#10;and pass control to it using -g" direction="Both" disabled="False" id="id45AB5BD525451" log="False" position="16">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="icmp-Unreachables"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="classify_str">1:10</Option>
               <Option name="classify_terminating_target">True</Option>
               <Option name="color">#7694C0</Option>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Classify" comment="second rule for bug #1618381" direction="Both" disabled="False" id="id45AB5BE125451" log="False" position="17">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id45AB5C6325451"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="classify_str">1:11</Option>
               <Option name="classify_terminating_target">True</Option>
               <Option name="color">#7694C0</Option>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Classify" direction="Outbound" disabled="False" id="id45AB5BED25451" log="True" position="18">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id45AB5C6325451"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="classify_str">1:11</Option>
               <Option name="classify_terminating_target">True</Option>
               <Option name="color">#7694C0</Option>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
               <Option name="tag_terminating_target">False</Option>
             </PolicyRuleOptions>
@@ -20958,39 +23559,43 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="icmp-Unreachables"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="classify_str">1:10</Option>
               <Option name="classify_terminating_target">True</Option>
               <Option name="color">#7694C0</Option>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
@@ -20998,280 +23603,307 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="icmp-Unreachables"/>
               <ServiceRef ref="tcp-HTTP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="classify_str">1:10</Option>
               <Option name="classify_terminating_target">True</Option>
               <Option name="color">#7694C0</Option>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Classify" comment="bug #1618381&#10;this rule uses multiport&#10;and has to be split because&#10;of that" direction="Both" disabled="False" id="id45AB5C1425451" log="False" position="21">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="id41D0F023"/>
               <ServiceRef ref="id3D4DE626"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id45AB5C6325451"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="classify_str">1:11</Option>
               <Option name="classify_terminating_target">True</Option>
               <Option name="color">#7694C0</Option>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Branch" comment="bug #1618381&#10;should generate branching code &#10;in both filter and mangle tables&#10;" direction="Both" disabled="False" id="id45AB5C2125451" log="False" position="22">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="tcp-All_TCP"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
+              <Option name="action_on_reject"></Option>
               <Option name="branch_name">rule27_branch</Option>
-              <Option name="classify_str"/>
+              <Option name="classify_str"></Option>
               <Option name="color">#7694C0</Option>
-              <Option name="custom_str"/>
-              <Option name="ipf_route_opt_addr"/>
-              <Option name="ipf_route_opt_if"/>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
               <Option name="ipf_route_option">route_through</Option>
               <Option name="ipfw_classify_method">2</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
               <Option name="ipfw_pipe_queue_num">0</Option>
               <Option name="ipt_branch_in_mangle">True</Option>
               <Option name="ipt_continue">False</Option>
-              <Option name="ipt_gw"/>
-              <Option name="ipt_iif"/>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
               <Option name="ipt_mark_connections">False</Option>
               <Option name="ipt_mark_prerouting">False</Option>
-              <Option name="ipt_oif"/>
+              <Option name="ipt_oif"></Option>
               <Option name="ipt_tee">False</Option>
               <Option name="pf_fastroute">False</Option>
-              <Option name="pf_route_opt_addr"/>
-              <Option name="pf_route_opt_if"/>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
               <Option name="pf_route_option">route_through</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Custom" comment="" direction="Both" disabled="False" id="id45AB5C3A25451" log="False" position="23">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
-              <Option name="action_on_reject"/>
-              <Option name="classify_str"/>
+              <Option name="action_on_reject"></Option>
+              <Option name="classify_str"></Option>
               <Option name="color">#C0C0C0</Option>
               <Option name="custom_str">-j TCPMSS --set-mss 1400</Option>
               <Option name="ipfw_pipe_method">0</Option>
               <Option name="ipfw_pipe_port_num">0</Option>
-              <Option name="rule_name_accounting"/>
+              <Option name="rule_name_accounting"></Option>
               <Option name="stateless">True</Option>
-              <Option name="tagvalue"/>
+              <Option name="tagvalue"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id45AB5C4625451" log="True" position="24">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          <Policy id="id45AB5C2D25451" name="rule27_branch">
-            <PolicyRule action="Classify" direction="Both" disabled="False" id="id45AB5C2E25451" log="False" position="0">
+        </Policy>
+        <Policy id="id45AB5C2D25451" name="rule27_branch">
+          <PolicyRule action="Classify" direction="Both" disabled="False" id="id45AB5C2E25451" log="False" position="0">
             <Src neg="False">
-                  <ObjectRef ref="sysid0"/>
-                </Src><Dst neg="False">
-                  <ObjectRef ref="sysid0"/>
-                </Dst><Srv neg="False">
-                  <ServiceRef ref="id459E36F110170"/>
-                </Srv><Itf neg="False">
-                  <ObjectRef ref="sysid0"/>
-                </Itf><When neg="False">
-                  <IntervalRef ref="sysid2"/>
-                </When>
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="id459E36F110170"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
             <PolicyRuleOptions>
-                  <Option name="action_on_reject"/>
-                  <Option name="classify_str">1:16</Option>
-                  <Option name="color">#7694C0</Option>
-                  <Option name="custom_str"/>
-                  <Option name="ipf_route_opt_addr"/>
-                  <Option name="ipf_route_opt_if"/>
-                  <Option name="ipf_route_option">route_through</Option>
-                  <Option name="ipfw_classify_method">2</Option>
-                  <Option name="ipfw_pipe_port_num">0</Option>
-                  <Option name="ipfw_pipe_queue_num">0</Option>
-                  <Option name="ipt_continue">False</Option>
-                  <Option name="ipt_gw"/>
-                  <Option name="ipt_iif"/>
-                  <Option name="ipt_mark_connections">False</Option>
-                  <Option name="ipt_mark_prerouting">False</Option>
-                  <Option name="ipt_oif"/>
-                  <Option name="ipt_tee">False</Option>
-                  <Option name="pf_fastroute">False</Option>
-                  <Option name="pf_route_opt_addr"/>
-                  <Option name="pf_route_opt_if"/>
-                  <Option name="pf_route_option">route_through</Option>
-                  <Option name="rule_name_accounting"/>
-                  <Option name="stateless">True</Option>
-                </PolicyRuleOptions>
+              <Option name="action_on_reject"></Option>
+              <Option name="classify_str">1:16</Option>
+              <Option name="color">#7694C0</Option>
+              <Option name="custom_str"></Option>
+              <Option name="ipf_route_opt_addr"></Option>
+              <Option name="ipf_route_opt_if"></Option>
+              <Option name="ipf_route_option">route_through</Option>
+              <Option name="ipfw_classify_method">2</Option>
+              <Option name="ipfw_pipe_port_num">0</Option>
+              <Option name="ipfw_pipe_queue_num">0</Option>
+              <Option name="ipt_continue">False</Option>
+              <Option name="ipt_gw"></Option>
+              <Option name="ipt_iif"></Option>
+              <Option name="ipt_mark_connections">False</Option>
+              <Option name="ipt_mark_prerouting">False</Option>
+              <Option name="ipt_oif"></Option>
+              <Option name="ipt_tee">False</Option>
+              <Option name="pf_fastroute">False</Option>
+              <Option name="pf_route_opt_addr"></Option>
+              <Option name="pf_route_opt_if"></Option>
+              <Option name="pf_route_option">route_through</Option>
+              <Option name="rule_name_accounting"></Option>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
           </PolicyRule>
           <PolicyRule action="Accept" direction="Both" disabled="False" id="id4640109629860" log="True" position="1">
             <Src neg="False">
-                  <ObjectRef ref="sysid0"/>
-                </Src><Dst neg="False">
-                  <ObjectRef ref="sysid0"/>
-                </Dst><Srv neg="False">
-                  <ServiceRef ref="tcp-HTTP"/>
-                </Srv><Itf neg="False">
-                  <ObjectRef ref="sysid0"/>
-                </Itf><When neg="False">
-                  <IntervalRef ref="sysid2"/>
-                </When>
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="tcp-HTTP"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
             <PolicyRuleOptions>
-                  <Option name="stateless">False</Option>
-                </PolicyRuleOptions>
+              <Option name="stateless">False</Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          <Routing id="id45AB5C6225451" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="" dyn="False" id="id45AB5C6325451" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.22" comment="" id="id45AB5C6525451" name="firewall37-1:eth0:ip" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id45AB5C6625451" label="eth1(outside)" mgmt="False" name="eth1" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="22.22.23.22" comment="" id="id45AB5C6825451" name="firewall37-1:eth1:ip" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" comment="" dyn="False" id="id45AB5C6925451" label="eth2(dmz)" mgmt="False" name="eth2" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="192.168.2.1" comment="this interface is on the subnet that overlaps with eth1" id="id45AB5C6B25451" name="firewall37-1:eth2:ip" netmask="255.255.255.0"/>
+        </Policy>
+        <Routing id="id45AB5C6225451" name="Routing"/>
+        <Interface bridgeport="False" comment="" dyn="False" id="id45AB5C6325451" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id45AB5C6525451" name="firewall37-1:eth0:ip" address="192.168.1.22" netmask="255.255.255.0"/>
         </Interface>
-          <Management address="192.168.1.22">
+        <Interface bridgeport="False" comment="" dyn="False" id="id45AB5C6625451" label="eth1(outside)" mgmt="False" name="eth1" security_level="0" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id45AB5C6825451" name="firewall37-1:eth1:ip" address="22.22.23.22" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" comment="" dyn="False" id="id45AB5C6925451" label="eth2(dmz)" mgmt="False" name="eth2" security_level="0" unnum="False" unprotected="False">
+          <IPv4 comment="this interface is on the subnet that overlaps with eth1" id="id45AB5C6B25451" name="firewall37-1:eth2:ip" address="192.168.2.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Management address="192.168.1.22">
           <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP host prohibited</Option>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="classify_mark_terminating">True</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">True</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
-          <Option name="epilog_script"/>
-          <Option name="firewall_dir"/>
+          <Option name="epilog_script"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">True</Option>
-          <Option name="limit_suffix"/>
+          <Option name="limit_suffix"></Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">True</Option>
           <Option name="local_nat">True</Option>
           <Option name="log_all">False</Option>
@@ -21283,16 +23915,16 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">True</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
-          <Option name="sshArgs"/>
+          <Option name="prolog_script"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -21301,21 +23933,24 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="simple test for a rule that matches local broadcast and should go into INPUT chain, but internal interface of the firewall is dynamic so compiler can not determine that given address is broadcast. Using fake interface to make this address match.&#10;&#10;" host_OS="linux24" id="id46EFBD7031183" inactive="False" lastCompiled="1188097218" lastInstalled="1142003872" lastModified="1190091778" name="firewall42" platform="iptables" ro="False" version="">
-        <NAT id="id46EFBE3731183" name="NAT">
-          </NAT>
-          <Policy id="id46EFBD7631183" name="Policy">
+        <NAT id="id46EFBE3731183" name="NAT"/>
+        <Policy id="id46EFBD7631183" name="Policy">
           <PolicyRule action="Accept" direction="Inbound" disabled="False" id="id46EFBD7731183" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3B64FFAC"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="udp-bootps"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id46EFBE4731183"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -21323,13 +23958,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="" direction="Inbound" disabled="False" id="id46EFBD8331183" log="False" position="1">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3CFBE20C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="udp-bootps"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id46EFBE4731183"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -21337,13 +23976,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="" direction="Inbound" disabled="False" id="id46EFBD8F31183" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3A84EECE"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="udp-bootps"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id46EFBE4731183"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -21351,13 +23994,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" comment="" direction="Inbound" disabled="False" id="id46EFBD9B31183" log="False" position="3">
             <Src neg="False">
               <ObjectRef ref="id40236C9A"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3CFBE20C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="udp-bootps"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id46EFBE4731183"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
@@ -21365,82 +24012,85 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Accept" direction="Outbound" disabled="False" id="id46EFBDA731183" log="False" position="4">
             <Src neg="False">
               <ObjectRef ref="id46EFBE4731183"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="id3CFBE20C"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="udp-bootpc"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="id46EFBE4731183"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id46EFBE4631183" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="" dyn="True" id="id46EFBE4731183" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False"/><Interface bridgeport="False" dyn="False" id="id46EFBE4A31183" name="eth1" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="22.22.22.22" id="id46EFBE4C31183" name="firewall42:eth1:ip" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id46EFBE5031183" name="lo" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="127.0.0.1" id="id46EFBE5231183" name="firewall42:lo:ip" netmask="255.0.0.0"/>
-          <IPv4 address="192.168.1.1" comment="" id="id46EFBE5B31183" name="firewall42:lo:ip-1" netmask="255.255.255.0"/>
+        </Policy>
+        <Routing id="id46EFBE4631183" name="Routing"/>
+        <Interface bridgeport="False" comment="" dyn="True" id="id46EFBE4731183" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False"/>
+        <Interface bridgeport="False" dyn="False" id="id46EFBE4A31183" name="eth1" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id46EFBE4C31183" name="firewall42:eth1:ip" address="22.22.22.22" netmask="255.255.255.0"/>
         </Interface>
-          <Management address="0.0.0.0">
+        <Interface bridgeport="False" dyn="False" id="id46EFBE5031183" name="lo" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id46EFBE5231183" name="firewall42:lo:ip" address="127.0.0.1" netmask="255.0.0.0"/>
+          <IPv4 comment="" id="id46EFBE5B31183" name="firewall42:lo:ip-1" address="192.168.1.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Management address="0.0.0.0">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="classify_mark_terminating">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">False</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="epilog_script"/>
-          <Option name="firewall_dir"/>
+          <Option name="epilog_script"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">False</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -21450,25 +24100,25 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">False</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_ipv6_default_policy">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="platform">iptables</Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"/>
+          <Option name="prolog_script"></Option>
           <Option name="proxy_arp">False</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
-          <Option name="sshArgs"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -21478,22 +24128,25 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
       <Firewall comment="testing action 'Continue'&#10;" host_OS="linux24" id="id47339E9919714" inactive="False" lastCompiled="1188097218" lastInstalled="1142003872" lastModified="1194539763" name="firewall50" platform="iptables" ro="False" version="">
-        <NAT id="id47339EDC19714" name="NAT">
-          </NAT>
-          <Policy id="id47339E9F19714" name="Policy">
+        <NAT id="id47339EDC19714" name="NAT"/>
+        <Policy id="id47339E9F19714" name="Policy">
           <PolicyRule action="Continue" direction="Both" disabled="False" id="id47339EFA19714" log="False" position="0">
             <Src neg="False">
               <ObjectRef ref="id3CEBFDFC"/>
               <ObjectRef ref="id4733FFE419714"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -21504,13 +24157,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id47339EEC19714" log="True" position="1">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE6"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -21521,13 +24178,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Branch" direction="Both" disabled="False" id="id4734305119714" log="False" position="2">
             <Src neg="False">
               <ObjectRef ref="id3DC75CE6"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -21540,13 +24201,17 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
             <Src neg="True">
               <ObjectRef ref="id3CEBFDFC"/>
               <ObjectRef ref="id4733FFE419714"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
@@ -21556,105 +24221,112 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <PolicyRule action="Deny" direction="Both" disabled="False" id="id47339F0719714" log="True" position="4">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
-            </Src><Dst neg="False">
+            </Src>
+            <Dst neg="False">
               <ObjectRef ref="sysid0"/>
-            </Dst><Srv neg="False">
+            </Dst>
+            <Srv neg="False">
               <ServiceRef ref="sysid1"/>
-            </Srv><Itf neg="False">
+            </Srv>
+            <Itf neg="False">
               <ObjectRef ref="sysid0"/>
-            </Itf><When neg="False">
+            </Itf>
+            <When neg="False">
               <IntervalRef ref="sysid2"/>
             </When>
             <PolicyRuleOptions>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          <Policy id="id4734305D19714" name="rule2_branch">
-            <PolicyRule action="Deny" comment="" direction="Both" disabled="False" id="id4734305F19714" log="True" position="0">
+        </Policy>
+        <Policy id="id4734305D19714" name="rule2_branch">
+          <PolicyRule action="Deny" comment="" direction="Both" disabled="False" id="id4734305F19714" log="True" position="0">
             <Src neg="True">
-                  <ObjectRef ref="id3CEBFDFC"/>
-                  <ObjectRef ref="id4733FFE419714"/>
-                </Src><Dst neg="False">
-                  <ObjectRef ref="sysid0"/>
-                </Dst><Srv neg="False">
-                  <ServiceRef ref="sysid1"/>
-                </Srv><Itf neg="False">
-                  <ObjectRef ref="sysid0"/>
-                </Itf><When neg="False">
-                  <IntervalRef ref="sysid2"/>
-                </When>
+              <ObjectRef ref="id3CEBFDFC"/>
+              <ObjectRef ref="id4733FFE419714"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
             <PolicyRuleOptions>
-                  <Option name="stateless">True</Option>
-                </PolicyRuleOptions>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
           </PolicyRule>
-          </Policy>
-          
-          <Routing id="id47339EDD19714" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="" dyn="False" id="id47339EDE19714" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="192.168.1.1" comment="" id="id47339EF819714" name="firewall50:eth0:ip" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id47339EDF19714" name="eth1" security_level="0" unnum="False" unprotected="False">
-          <IPv4 address="22.22.22.22" id="id47339EE119714" name="firewall50:eth1:ip" netmask="255.255.255.0"/>
-        </Interface><Interface bridgeport="False" dyn="False" id="id47339EE219714" name="lo" security_level="100" unnum="False" unprotected="False">
-          <IPv4 address="127.0.0.1" id="id47339EE519714" name="firewall50:lo:ip1" netmask="255.0.0.0"/>
-          <IPv4 address="192.168.1.1" comment="" id="id47339EE619714" name="firewall50:lo:ip2" netmask="255.255.255.0"/>
+        </Policy>
+        <Routing id="id47339EDD19714" name="Routing"/>
+        <Interface bridgeport="False" comment="" dyn="False" id="id47339EDE19714" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
+          <IPv4 comment="" id="id47339EF819714" name="firewall50:eth0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
         </Interface>
-          <Management address="0.0.0.0">
+        <Interface bridgeport="False" dyn="False" id="id47339EDF19714" name="eth1" security_level="0" unnum="False" unprotected="False">
+          <IPv4 id="id47339EE119714" name="firewall50:eth1:ip" address="22.22.22.22" netmask="255.255.255.0"/>
+        </Interface>
+        <Interface bridgeport="False" dyn="False" id="id47339EE219714" name="lo" security_level="100" unnum="False" unprotected="False">
+          <IPv4 id="id47339EE519714" name="firewall50:lo:ip1" address="127.0.0.1" netmask="255.0.0.0"/>
+          <IPv4 comment="" id="id47339EE619714" name="firewall50:lo:ip2" address="192.168.1.1" netmask="255.255.255.0"/>
+        </Interface>
+        <Management address="0.0.0.0">
           <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
           <FWBDManagement enabled="True" identity="" port="9999"/>
           <PolicyInstallScript arguments="" command="" enabled="False"/>
         </Management>
-          <FirewallOptions>
+        <FirewallOptions>
           <Option name="accept_established">True</Option>
           <Option name="accept_new_tcp_with_no_syn">True</Option>
           <Option name="action_on_reject">ICMP net unreachable</Option>
-          <Option name="activationCmd"/>
-          <Option name="admUser"/>
-          <Option name="altAddress"/>
+          <Option name="activationCmd"></Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
           <Option name="bridging_fw">False</Option>
           <Option name="check_shading">False</Option>
           <Option name="clamp_mss_to_mtu">False</Option>
           <Option name="classify_mark_terminating">False</Option>
-          <Option name="cmdline"/>
-          <Option name="compiler"/>
+          <Option name="cmdline"></Option>
+          <Option name="compiler"></Option>
           <Option name="configure_interfaces">False</Option>
           <Option name="debug">False</Option>
           <Option name="drop_invalid">False</Option>
           <Option name="dyn_addr">False</Option>
-          <Option name="epilog_script"/>
-          <Option name="firewall_dir"/>
+          <Option name="epilog_script"></Option>
+          <Option name="firewall_dir"></Option>
           <Option name="firewall_is_part_of_any">True</Option>
           <Option name="firewall_is_part_of_any_and_networks">True</Option>
           <Option name="ignore_empty_groups">False</Option>
-          <Option name="inst_cmdline"/>
-          <Option name="inst_script"/>
-          <Option name="install_script"/>
+          <Option name="inst_cmdline"></Option>
+          <Option name="inst_script"></Option>
+          <Option name="install_script"></Option>
           <Option name="limit_suffix">/day</Option>
           <Option name="limit_value">0</Option>
-          <Option name="linux24_accept_redirects"/>
-          <Option name="linux24_accept_source_route"/>
-          <Option name="linux24_icmp_echo_ignore_all"/>
-          <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-          <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-          <Option name="linux24_ip_dynaddr"/>
-          <Option name="linux24_ip_forward"/>
-          <Option name="linux24_log_martians"/>
-          <Option name="linux24_path_ip"/>
-          <Option name="linux24_path_iptables"/>
-          <Option name="linux24_path_logger"/>
-          <Option name="linux24_path_lsmod"/>
-          <Option name="linux24_path_modprobe"/>
-          <Option name="linux24_rp_filter"/>
-          <Option name="linux24_tcp_ecn"/>
-          <Option name="linux24_tcp_fack"/>
+          <Option name="linux24_accept_redirects"></Option>
+          <Option name="linux24_accept_source_route"></Option>
+          <Option name="linux24_icmp_echo_ignore_all"></Option>
+          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+          <Option name="linux24_ip_dynaddr"></Option>
+          <Option name="linux24_ip_forward"></Option>
+          <Option name="linux24_log_martians"></Option>
+          <Option name="linux24_path_ip"></Option>
+          <Option name="linux24_path_iptables"></Option>
+          <Option name="linux24_path_logger"></Option>
+          <Option name="linux24_path_lsmod"></Option>
+          <Option name="linux24_path_modprobe"></Option>
+          <Option name="linux24_rp_filter"></Option>
+          <Option name="linux24_tcp_ecn"></Option>
+          <Option name="linux24_tcp_fack"></Option>
           <Option name="linux24_tcp_fin_timeout">30</Option>
           <Option name="linux24_tcp_keepalive_interval">1800</Option>
-          <Option name="linux24_tcp_sack"/>
-          <Option name="linux24_tcp_syncookies"/>
-          <Option name="linux24_tcp_timestamps"/>
-          <Option name="linux24_tcp_window_scaling"/>
+          <Option name="linux24_tcp_sack"></Option>
+          <Option name="linux24_tcp_syncookies"></Option>
+          <Option name="linux24_tcp_timestamps"></Option>
+          <Option name="linux24_tcp_window_scaling"></Option>
           <Option name="load_modules">False</Option>
           <Option name="local_nat">False</Option>
           <Option name="log_all">False</Option>
@@ -21664,25 +24336,25 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="log_level">debug</Option>
           <Option name="log_limit_suffix">/second</Option>
           <Option name="log_limit_value">0</Option>
-          <Option name="log_prefix"/>
+          <Option name="log_prefix"></Option>
           <Option name="log_tcp_opt">False</Option>
           <Option name="log_tcp_seq">False</Option>
           <Option name="manage_virtual_addr">False</Option>
-          <Option name="mgmt_addr"/>
+          <Option name="mgmt_addr"></Option>
           <Option name="mgmt_ssh">False</Option>
           <Option name="no_iochains_for_any">False</Option>
           <Option name="no_ipv6_default_policy">False</Option>
           <Option name="no_optimisation">False</Option>
-          <Option name="output_file"/>
+          <Option name="output_file"></Option>
           <Option name="platform">iptables</Option>
           <Option name="prolog_place">top</Option>
-          <Option name="prolog_script"/>
+          <Option name="prolog_script"></Option>
           <Option name="proxy_arp">False</Option>
-          <Option name="script_env_path"/>
-          <Option name="snmp_contact"/>
-          <Option name="snmp_description"/>
-          <Option name="snmp_location"/>
-          <Option name="sshArgs"/>
+          <Option name="script_env_path"></Option>
+          <Option name="snmp_contact"></Option>
+          <Option name="snmp_description"></Option>
+          <Option name="snmp_location"></Option>
+          <Option name="sshArgs"></Option>
           <Option name="ulog_cprange">0</Option>
           <Option name="ulog_nlgroup">1</Option>
           <Option name="ulog_qthreshold">1</Option>
@@ -21692,19 +24364,341 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="use_numeric_log_levels">False</Option>
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
-          </Firewall>
+      </Firewall>
+      <Firewall comment="" host_OS="linux24" id="id4833F62B6131" inactive="False" lastCompiled="1211586650" lastInstalled="0" lastModified="1212115906" name="firewall-ipv6-1" platform="iptables" ro="False" version="">
+        <NAT id="id4833F62F6131" name="NAT"/>
+        <Policy id="id483F5B7623190" name="Policy_ipv4"/>
+        <Policy id="id4833F62E6131" name="Policy">
+          <PolicyRule action="Accept" comment="this rule shadows the next.&#10;Note that we add command line&#10;flag -xt to the compiler" direction="Both" disabled="False" group="" id="id4837BFE628819" log="False" position="0">
+            <Src neg="False">
+              <ObjectRef ref="id4834B9206131"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="id4833F6316131"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="tcp-SSH"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">False</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule action="Accept" comment="" direction="Both" disabled="False" id="id4834578B6131" log="False" position="1">
+            <Src neg="False">
+              <ObjectRef ref="id483426D06131"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="id4833F6316131"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="tcp-SSH"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">False</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule action="Accept" direction="Both" disabled="False" id="id4834577C6131" log="True" position="2">
+            <Src neg="False">
+              <ObjectRef ref="id483426D06131"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="id4833F62B6131"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="tcp-SSH"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">False</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule action="Accept" direction="Both" disabled="False" group="" id="id4834D3038571" log="True" position="3">
+            <Src neg="False">
+              <ObjectRef ref="id4834A2238571"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="id4833F6316131"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="tcp-SSH"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">False</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule action="Accept" direction="Both" disabled="False" group="" id="id4834D3108571" log="True" position="4">
+            <Src neg="False">
+              <ObjectRef ref="id4834A2278571"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="id4833F6316131"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="tcp-SSH"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">False</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule action="Accept" comment="" direction="Both" disabled="False" group="" id="id4835040E8571" log="True" position="5">
+            <Src neg="False">
+              <ObjectRef ref="id4834A2238571"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="id4833F62B6131"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="tcp-SSH"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">False</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule action="Accept" comment="" direction="Both" disabled="False" group="" id="id4835041F8571" log="True" position="6">
+            <Src neg="False">
+              <ObjectRef ref="id4834A2278571"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="id4833F62B6131"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="tcp-SSH"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">False</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule action="Accept" direction="Inbound" disabled="False" id="id4834576F6131" log="True" position="7">
+            <Src neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="id4833F62B6131"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">False</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule action="Accept" direction="Both" disabled="False" id="id4834B9216131" log="True" position="8">
+            <Src neg="False">
+              <ObjectRef ref="id4834B9206131"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">False</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule action="Accept" direction="Both" disabled="False" id="id483566468571" log="True" position="9">
+            <Src neg="False">
+              <ObjectRef ref="id4834A2238571"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">False</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule action="Accept" direction="Both" disabled="False" id="id483566548571" log="True" position="10">
+            <Src neg="False">
+              <ObjectRef ref="id4834A2278571"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">False</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+        </Policy>
+        <Routing id="id4833F6306131" name="Routing"/>
+        <Interface bridgeport="False" dyn="False" id="id4833F6316131" label="" name="eth0" security_level="50" unnum="False" unprotected="False">
+          <IPv4 id="id4833F6326131" name="firewall-ipv6-1:eth0:ip" address="1.1.1.1" netmask="255.255.255.0"/>
+          <IPv6 comment="" id="id4833F6346131" name="firewall-ipv6-1:eth0:ipv6" address="fe80::21d:9ff:fe8b:8e94" netmask="64"/>
+        </Interface>
+        <Management address="1.1.1.1">
+          <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
+          <FWBDManagement enabled="False" identity="" port="-1"/>
+          <PolicyInstallScript arguments="" command="" enabled="False"/>
+        </Management>
+        <FirewallOptions>
+          <Option name="accept_established">True</Option>
+          <Option name="accept_new_tcp_with_no_syn">True</Option>
+          <Option name="action_on_reject"></Option>
+          <Option name="activationCmd"></Option>
+          <Option name="add_check_state_rule">true</Option>
+          <Option name="admUser"></Option>
+          <Option name="altAddress"></Option>
+          <Option name="bridging_fw">False</Option>
+          <Option name="check_shading">True</Option>
+          <Option name="clamp_mss_to_mtu">False</Option>
+          <Option name="classify_mark_terminating">False</Option>
+          <Option name="cmdline">-xt</Option>
+          <Option name="compiler"></Option>
+          <Option name="configure_interfaces">True</Option>
+          <Option name="debug">False</Option>
+          <Option name="drop_invalid">False</Option>
+          <Option name="eliminate_duplicates">true</Option>
+          <Option name="enable_ipv6">True</Option>
+          <Option name="epilog_script"></Option>
+          <Option name="firewall_dir">/etc</Option>
+          <Option name="firewall_is_part_of_any_and_networks">True</Option>
+          <Option name="freebsd_ip_forward">1</Option>
+          <Option name="ignore_empty_groups">False</Option>
+          <Option name="in_out_code">true</Option>
+          <Option name="iosacl_add_clear_statements">true</Option>
+          <Option name="iosacl_assume_fw_part_of_any">true</Option>
+          <Option name="iosacl_include_comments">true</Option>
+          <Option name="ipv4_6_order">ipv4_first</Option>
+          <Option name="limit_suffix"></Option>
+          <Option name="limit_value">0</Option>
+          <Option name="linux24_ip_forward">1</Option>
+          <Option name="load_modules">True</Option>
+          <Option name="local_nat">False</Option>
+          <Option name="log_all">False</Option>
+          <Option name="log_invalid">False</Option>
+          <Option name="log_ip_opt">False</Option>
+          <Option name="log_level">info</Option>
+          <Option name="log_prefix">RULE %N -- %A </Option>
+          <Option name="log_tcp_opt">False</Option>
+          <Option name="log_tcp_seq">False</Option>
+          <Option name="loopback_interface">lo0</Option>
+          <Option name="macosx_ip_forward">1</Option>
+          <Option name="manage_virtual_addr">True</Option>
+          <Option name="mgmt_addr"></Option>
+          <Option name="mgmt_ssh">False</Option>
+          <Option name="no_ipv6_default_policy">False</Option>
+          <Option name="openbsd_ip_forward">1</Option>
+          <Option name="output_file"></Option>
+          <Option name="pass_all_out">false</Option>
+          <Option name="pf_limit_frags">5000</Option>
+          <Option name="pf_limit_states">10000</Option>
+          <Option name="pf_scrub_maxmss">1460</Option>
+          <Option name="pf_timeout_frag">30</Option>
+          <Option name="pf_timeout_interval">10</Option>
+          <Option name="pix_add_clear_statements">true</Option>
+          <Option name="pix_assume_fw_part_of_any">true</Option>
+          <Option name="pix_default_logint">300</Option>
+          <Option name="pix_emblem_log_format">false</Option>
+          <Option name="pix_emulate_out_acl">true</Option>
+          <Option name="pix_floodguard">true</Option>
+          <Option name="pix_include_comments">true</Option>
+          <Option name="pix_route_dnat_supported">true</Option>
+          <Option name="pix_rule_syslog_settings">false</Option>
+          <Option name="pix_security_fragguard_supported">true</Option>
+          <Option name="pix_syslog_device_id_supported">false</Option>
+          <Option name="pix_use_acl_remarks">true</Option>
+          <Option name="prolog_place">top</Option>
+          <Option name="prolog_script"></Option>
+          <Option name="prompt1">$ </Option>
+          <Option name="prompt2"> # </Option>
+          <Option name="solaris_ip_forward">1</Option>
+          <Option name="sshArgs"></Option>
+          <Option name="ulog_cprange">0</Option>
+          <Option name="ulog_nlgroup">1</Option>
+          <Option name="ulog_qthreshold">1</Option>
+          <Option name="use_ULOG">False</Option>
+          <Option name="use_iptables_restore">False</Option>
+          <Option name="use_numeric_log_levels">False</Option>
+          <Option name="verify_interfaces">True</Option>
+        </FirewallOptions>
+      </Firewall>
     </ObjectGroup>
     <IntervalGroup id="stdid11_1" name="Time">
       <Interval comment="" from_day="-1" from_hour="1" from_minute="1" from_month="-1" from_weekday="0" from_year="-1" id="id3D6864D0" name="test time 1" to_day="-1" to_hour="2" to_minute="2" to_month="-1" to_weekday="1" to_year="-1"/>
       <Interval comment="" from_day="13" from_hour="1" from_minute="1" from_month="3" from_weekday="0" from_year="2007" id="id45F8C4E013056" name="test time 2" to_day="1" to_hour="2" to_minute="2" to_month="1" to_weekday="1" to_year="2010"/>
     </IntervalGroup>
+    <ObjectRef ref="id483F5B7623190"/>
+    <ObjectRef ref="id4833F6316131"/>
+    <ObjectRef ref="id4833F62E6131"/>
+    <ObjectRef ref="id4833F62F6131"/>
+    <ObjectRef ref="id4833F6306131"/>
   </Library>
   <Library id="sysid99" name="Deleted Objects" ro="False">
     <ObjectRef ref="sysid0"/>
-    <IPv4 address="192.168.1.1" comment="" id="id41D295E2" name="firewall30:ppp.200*:ip" netmask="255.255.255.0"/>
+    <IPv4 comment="" id="id41D295E2" name="firewall30:ppp.200*:ip" address="192.168.1.1" netmask="255.255.255.0"/>
     <Firewall comment="dynamic wildcard interface with a dot in the name" host_OS="linux24" id="id41D294BB" lastCompiled="0" lastInstalled="0" lastModified="0" name="firewall30" platform="iptables" ro="False" version="">
-        <NAT id="id41D2953D" name="NAT">
-          <NATRule disabled="False" id="id41D2953E" position="0">
+      <NAT id="id41D2953D" name="NAT">
+        <NATRule disabled="False" id="id41D2953E" position="0">
           <OSrc neg="False">
             <ObjectRef ref="net-Internal_net"/>
           </OSrc>
@@ -21724,7 +24718,8 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
             <ServiceRef ref="sysid1"/>
           </TSrv>
           <NATRuleOptions/>
-        </NATRule><NATRule comment="" disabled="False" id="id41D2954C" position="1">
+        </NATRule>
+        <NATRule comment="" disabled="False" id="id41D2954C" position="1">
           <OSrc neg="False">
             <ObjectRef ref="net-Internal_net"/>
           </OSrc>
@@ -21744,7 +24739,8 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
             <ServiceRef ref="sysid1"/>
           </TSrv>
           <NATRuleOptions/>
-        </NATRule><NATRule comment="" disabled="False" id="id41D2955A" position="2">
+        </NATRule>
+        <NATRule comment="" disabled="False" id="id41D2955A" position="2">
           <OSrc neg="False">
             <ObjectRef ref="sysid0"/>
           </OSrc>
@@ -21764,7 +24760,8 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
             <ServiceRef ref="tcp-SSH"/>
           </TSrv>
           <NATRuleOptions/>
-        </NATRule><NATRule disabled="False" id="id41D29568" position="3">
+        </NATRule>
+        <NATRule disabled="False" id="id41D29568" position="3">
           <OSrc neg="False">
             <ObjectRef ref="net-Internal_net"/>
           </OSrc>
@@ -21784,372 +24781,444 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
             <ServiceRef ref="sysid1"/>
           </TSrv>
           <NATRuleOptions/>
-        </NATRule></NAT>
-          <Policy id="id41D294C0" name="Policy">
-          <PolicyRule action="Deny" comment="ppp clients get addresses on 10.1.1.0" direction="Inbound" disabled="False" id="id41D295AE" log="True" position="0">
-            <Src neg="True">
+        </NATRule>
+      </NAT>
+      <Policy id="id41D294C0" name="Policy">
+        <PolicyRule action="Deny" comment="ppp clients get addresses on 10.1.1.0" direction="Inbound" disabled="False" id="id41D295AE" log="True" position="0">
+          <Src neg="True">
             <ObjectRef ref="id3EFBCCBA"/>
-          </Src><Dst neg="False">
+          </Src>
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
-          </Dst><Srv neg="False">
+          </Dst>
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
-          </Srv><Itf neg="False">
+          </Srv>
+          <Itf neg="False">
             <ObjectRef ref="id41D29576"/>
-          </Itf><When neg="False">
+          </Itf>
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
+          <PolicyRuleOptions>
             <Option name="stateless">True</Option>
           </PolicyRuleOptions>
-          </PolicyRule>
-          <PolicyRule action="Deny" comment="ppp clients can not connect to the firewall" direction="Inbound" disabled="False" id="id41D295B8" log="True" position="1">
-            <Src neg="False">
+        </PolicyRule>
+        <PolicyRule action="Deny" comment="ppp clients can not connect to the firewall" direction="Inbound" disabled="False" id="id41D295B8" log="True" position="1">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
-          </Src><Dst neg="False">
+          </Src>
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
-          </Dst><Srv neg="False">
+          </Dst>
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
-          </Srv><Itf neg="False">
+          </Srv>
+          <Itf neg="False">
             <ObjectRef ref="id41D29576"/>
-          </Itf><When neg="False">
+          </Itf>
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
+          <PolicyRuleOptions>
             <Option name="stateless">True</Option>
           </PolicyRuleOptions>
-          </PolicyRule>
-          <PolicyRule action="Deny" direction="Inbound" disabled="False" id="id41D295C2" log="True" position="2">
-            <Src neg="False">
+        </PolicyRule>
+        <PolicyRule action="Deny" direction="Inbound" disabled="False" id="id41D295C2" log="True" position="2">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
-          </Src><Dst neg="False">
+          </Src>
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
-          </Dst><Srv neg="False">
+          </Dst>
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
-          </Srv><Itf neg="False">
+          </Srv>
+          <Itf neg="False">
             <ObjectRef ref="id41D29576"/>
-          </Itf><When neg="False">
+          </Itf>
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
+          <PolicyRuleOptions>
             <Option name="stateless">True</Option>
           </PolicyRuleOptions>
-          </PolicyRule>
-          <PolicyRule action="Accept" comment="ppp clients can only connect to the mail&#10;server and web proxy on DMZ" direction="Inbound" disabled="False" id="id41D295CC" log="False" position="3">
-            <Src neg="False">
+        </PolicyRule>
+        <PolicyRule action="Accept" comment="ppp clients can only connect to the mail&#10;server and web proxy on DMZ" direction="Inbound" disabled="False" id="id41D295CC" log="False" position="3">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
-          </Src><Dst neg="False">
+          </Src>
+          <Dst neg="False">
             <ObjectRef ref="id3D151943"/>
-          </Dst><Srv neg="False">
+          </Dst>
+          <Srv neg="False">
             <ServiceRef ref="tcp-SMTP"/>
             <ServiceRef ref="id3B4FF09A"/>
-          </Srv><Itf neg="False">
+          </Srv>
+          <Itf neg="False">
             <ObjectRef ref="id41D29576"/>
-          </Itf><When neg="False">
+          </Itf>
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions/>
-          </PolicyRule>
-          <PolicyRule action="Deny" comment="ppp clients can not connect to&#10;anything else on DMZ and&#10;internal net" direction="Inbound" disabled="False" id="id41D295D7" log="True" position="4">
-            <Src neg="False">
+          <PolicyRuleOptions/>
+        </PolicyRule>
+        <PolicyRule action="Deny" comment="ppp clients can not connect to&#10;anything else on DMZ and&#10;internal net" direction="Inbound" disabled="False" id="id41D295D7" log="True" position="4">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
-          </Src><Dst neg="False">
+          </Src>
+          <Dst neg="False">
             <ObjectRef ref="id3B022266"/>
             <ObjectRef ref="net-Internal_net"/>
-          </Dst><Srv neg="False">
+          </Dst>
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
-          </Srv><Itf neg="False">
+          </Srv>
+          <Itf neg="False">
             <ObjectRef ref="id41D29576"/>
-          </Itf><When neg="False">
+          </Itf>
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
+          <PolicyRuleOptions>
             <Option name="stateless">True</Option>
           </PolicyRuleOptions>
-          </PolicyRule>
-          <PolicyRule action="Deny" comment="" direction="Inbound" disabled="False" id="id41D295F6" log="True" position="5">
-            <Src neg="True">
+        </PolicyRule>
+        <PolicyRule action="Deny" comment="" direction="Inbound" disabled="False" id="id41D295F6" log="True" position="5">
+          <Src neg="True">
             <ObjectRef ref="id3B022266"/>
-          </Src><Dst neg="False">
+          </Src>
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
-          </Dst><Srv neg="False">
+          </Dst>
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
-          </Srv><Itf neg="False">
+          </Srv>
+          <Itf neg="False">
             <ObjectRef ref="id41D295E8"/>
-          </Itf><When neg="False">
+          </Itf>
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
+          <PolicyRuleOptions>
             <Option name="stateless">True</Option>
           </PolicyRuleOptions>
-          </PolicyRule>
-          <PolicyRule action="Accept" comment="hostF has the same IP address as firewal." disabled="False" id="id41D294C1" log="True" position="6">
-            <Src neg="False">
+        </PolicyRule>
+        <PolicyRule action="Accept" comment="hostF has the same IP address as firewal." disabled="False" id="id41D294C1" log="True" position="6">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
-          </Src><Dst neg="False">
+          </Src>
+          <Dst neg="False">
             <ObjectRef ref="id3AFC191C"/>
-          </Dst><Srv neg="False">
+          </Dst>
+          <Srv neg="False">
             <ServiceRef ref="icmp-ping_request"/>
-          </Srv><Itf neg="False">
+          </Srv>
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
-          </Itf><When neg="False">
+          </Itf>
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
-            <Option name="id"/>
+          <PolicyRuleOptions>
+            <Option name="id"></Option>
           </PolicyRuleOptions>
-          </PolicyRule>
-          <PolicyRule action="Accept" disabled="False" id="id41D294CB" log="False" position="7">
-            <Src neg="False">
+        </PolicyRule>
+        <PolicyRule action="Accept" disabled="False" id="id41D294CB" log="False" position="7">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
-          </Src><Dst neg="False">
+          </Src>
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
-          </Dst><Srv neg="False">
+          </Dst>
+          <Srv neg="False">
             <ServiceRef ref="tcp-SSH"/>
-          </Srv><Itf neg="False">
+          </Srv>
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
-          </Itf><When neg="False">
+          </Itf>
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions/>
-          </PolicyRule>
-          <PolicyRule action="Accept" comment="" disabled="False" id="id41D294D5" log="False" position="8">
-            <Src neg="False">
+          <PolicyRuleOptions/>
+        </PolicyRule>
+        <PolicyRule action="Accept" comment="" disabled="False" id="id41D294D5" log="False" position="8">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
-          </Src><Dst neg="False">
+          </Src>
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
-          </Dst><Srv neg="False">
+          </Dst>
+          <Srv neg="False">
             <ServiceRef ref="tcp-SSH"/>
-          </Srv><Itf neg="False">
+          </Srv>
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
-          </Itf><When neg="False">
+          </Itf>
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions/>
-          </PolicyRule>
-          <PolicyRule action="Accept" comment="" disabled="False" id="id41D294DF" log="False" position="9">
-            <Src neg="False">
+          <PolicyRuleOptions/>
+        </PolicyRule>
+        <PolicyRule action="Accept" comment="" disabled="False" id="id41D294DF" log="False" position="9">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
-          </Src><Dst neg="False">
+          </Src>
+          <Dst neg="False">
             <ObjectRef ref="id3B19BF58"/>
-          </Dst><Srv neg="False">
+          </Dst>
+          <Srv neg="False">
             <ServiceRef ref="tcp-SSH"/>
-          </Srv><Itf neg="False">
+          </Srv>
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
-          </Itf><When neg="False">
+          </Itf>
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions/>
-          </PolicyRule>
-          <PolicyRule action="Accept" disabled="False" id="id41D294E9" log="False" position="10">
-            <Src neg="False">
+          <PolicyRuleOptions/>
+        </PolicyRule>
+        <PolicyRule action="Accept" disabled="False" id="id41D294E9" log="False" position="10">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
-          </Src><Dst neg="False">
+          </Src>
+          <Dst neg="False">
             <ObjectRef ref="id3AFC191C"/>
-          </Dst><Srv neg="False">
+          </Dst>
+          <Srv neg="False">
             <ServiceRef ref="tcp-SSH"/>
             <ServiceRef ref="tcp-Telnet"/>
-          </Srv><Itf neg="False">
+          </Srv>
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
-          </Itf><When neg="False">
+          </Itf>
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions/>
-          </PolicyRule>
-          <PolicyRule action="Accept" comment="" disabled="False" id="id41D294F4" log="False" position="11">
-            <Src neg="False">
+          <PolicyRuleOptions/>
+        </PolicyRule>
+        <PolicyRule action="Accept" comment="" disabled="False" id="id41D294F4" log="False" position="11">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
-          </Src><Dst neg="False">
+          </Src>
+          <Dst neg="False">
             <ObjectRef ref="id3E9870D1"/>
-          </Dst><Srv neg="False">
+          </Dst>
+          <Srv neg="False">
             <ServiceRef ref="tcp-SSH"/>
             <ServiceRef ref="tcp-Telnet"/>
-          </Srv><Itf neg="False">
+          </Srv>
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
-          </Itf><When neg="False">
+          </Itf>
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions/>
-          </PolicyRule>
-          <PolicyRule action="Accept" comment="" disabled="False" id="id41D294FF" log="True" position="12">
-            <Src neg="False">
+          <PolicyRuleOptions/>
+        </PolicyRule>
+        <PolicyRule action="Accept" comment="" disabled="False" id="id41D294FF" log="True" position="12">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
-          </Src><Dst neg="False">
+          </Src>
+          <Dst neg="False">
             <ObjectRef ref="id3E9870D1"/>
-          </Dst><Srv neg="False">
+          </Dst>
+          <Srv neg="False">
             <ServiceRef ref="tcp-SSH"/>
             <ServiceRef ref="tcp-Telnet"/>
-          </Srv><Itf neg="False">
+          </Srv>
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
-          </Itf><When neg="False">
+          </Itf>
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions/>
-          </PolicyRule>
-          <PolicyRule action="Accept" comment="firewall is part of Any, so compiler should&#10;generate code in both FORWARD and&#10;OUTPUT chains" disabled="False" id="id41D2950A" log="False" position="13">
-            <Src neg="False">
+          <PolicyRuleOptions/>
+        </PolicyRule>
+        <PolicyRule action="Accept" comment="firewall is part of Any, so compiler should&#10;generate code in both FORWARD and&#10;OUTPUT chains" disabled="False" id="id41D2950A" log="False" position="13">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
-          </Src><Dst neg="False">
+          </Src>
+          <Dst neg="False">
             <ObjectRef ref="id3B19C5EB"/>
-          </Dst><Srv neg="False">
+          </Dst>
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
-          </Srv><Itf neg="False">
+          </Srv>
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
-          </Itf><When neg="False">
+          </Itf>
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions/>
-          </PolicyRule>
-          <PolicyRule action="Accept" comment="firewall is part of Any, compiler should&#10;generate code for both FORWARD and&#10;INPUT chains" disabled="False" id="id41D29514" log="False" position="14">
-            <Src neg="False">
+          <PolicyRuleOptions/>
+        </PolicyRule>
+        <PolicyRule action="Accept" comment="firewall is part of Any, compiler should&#10;generate code for both FORWARD and&#10;INPUT chains" disabled="False" id="id41D29514" log="False" position="14">
+          <Src neg="False">
             <ObjectRef ref="id3B19C5EB"/>
-          </Src><Dst neg="False">
+          </Src>
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
-          </Dst><Srv neg="False">
+          </Dst>
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
-          </Srv><Itf neg="False">
+          </Srv>
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
-          </Itf><When neg="False">
+          </Itf>
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions/>
-          </PolicyRule>
-          <PolicyRule action="Accept" comment="because firewall has interface on network&#10;internal_net, compiler should generate code&#10;for both FORWARD and INPUT chains" disabled="False" id="id41D2951E" log="False" position="15">
-            <Src neg="False">
+          <PolicyRuleOptions/>
+        </PolicyRule>
+        <PolicyRule action="Accept" comment="because firewall has interface on network&#10;internal_net, compiler should generate code&#10;for both FORWARD and INPUT chains" disabled="False" id="id41D2951E" log="False" position="15">
+          <Src neg="False">
             <ObjectRef ref="host-hostA"/>
-          </Src><Dst neg="False">
+          </Src>
+          <Dst neg="False">
             <ObjectRef ref="net-Internal_net"/>
-          </Dst><Srv neg="False">
+          </Dst>
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
-          </Srv><Itf neg="False">
+          </Srv>
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
-          </Itf><When neg="False">
+          </Itf>
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions/>
-          </PolicyRule>
-          <PolicyRule action="Accept" comment="" disabled="False" id="id41D29528" log="False" position="16">
-            <Src neg="False">
+          <PolicyRuleOptions/>
+        </PolicyRule>
+        <PolicyRule action="Accept" comment="" disabled="False" id="id41D29528" log="False" position="16">
+          <Src neg="False">
             <ObjectRef ref="net-Internal_net"/>
             <ObjectRef ref="id3B022266"/>
-          </Src><Dst neg="False">
+          </Src>
+          <Dst neg="False">
             <ObjectRef ref="id3B19C5EB"/>
-          </Dst><Srv neg="False">
+          </Dst>
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
-          </Srv><Itf neg="False">
+          </Srv>
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
-          </Itf><When neg="False">
+          </Itf>
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions/>
-          </PolicyRule>
-          <PolicyRule action="Deny" comment="Automatically generated 'catch all' rule" disabled="False" id="id41D29533" log="True" position="17">
-            <Src neg="False">
+          <PolicyRuleOptions/>
+        </PolicyRule>
+        <PolicyRule action="Deny" comment="Automatically generated 'catch all' rule" disabled="False" id="id41D29533" log="True" position="17">
+          <Src neg="False">
             <ObjectRef ref="sysid0"/>
-          </Src><Dst neg="False">
+          </Src>
+          <Dst neg="False">
             <ObjectRef ref="sysid0"/>
-          </Dst><Srv neg="False">
+          </Dst>
+          <Srv neg="False">
             <ServiceRef ref="sysid1"/>
-          </Srv><Itf neg="False">
+          </Srv>
+          <Itf neg="False">
             <ObjectRef ref="sysid0"/>
-          </Itf><When neg="False">
+          </Itf>
+          <When neg="False">
             <IntervalRef ref="sysid2"/>
           </When>
-            <PolicyRuleOptions>
-            <Option name="action_on_reject"/>
-            <Option name="id"/>
-            <Option name="limit_suffix"/>
+          <PolicyRuleOptions>
+            <Option name="action_on_reject"></Option>
+            <Option name="id"></Option>
+            <Option name="limit_suffix"></Option>
             <Option name="limit_value">0</Option>
-            <Option name="log_prefix"/>
+            <Option name="log_prefix"></Option>
             <Option name="stateless">True</Option>
           </PolicyRuleOptions>
-          </PolicyRule>
-          </Policy>
-          
-          
-          <Routing id="id41D294BB-routing" name="Routing">
-          </Routing>
-          <Interface bridgeport="False" comment="" dyn="True" id="id41D29576" label="" mgmt="False" name="ppp.200*" security_level="0" unnum="False" unprotected="False"/><Interface bridgeport="False" comment="" dyn="False" id="id41D295E3" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
-        <IPv4 address="192.168.1.1" id="id41D295E7" name="firewall30:eth0:ip" netmask="255.255.255.0"/>
-      </Interface><Interface bridgeport="False" dyn="False" id="id41D295E8" name="eth2" security_level="0" unnum="False" unprotected="False">
-        <IPv4 address="192.168.2.1" id="id41D29600" name="firewall30:eth2:ip" netmask="255.255.255.0"/>
+        </PolicyRule>
+      </Policy>
+      <Routing id="id41D294BB-routing" name="Routing"/>
+      <Interface bridgeport="False" comment="" dyn="True" id="id41D29576" label="" mgmt="False" name="ppp.200*" security_level="0" unnum="False" unprotected="False"/>
+      <Interface bridgeport="False" comment="" dyn="False" id="id41D295E3" label="" mgmt="True" name="eth0" security_level="100" unnum="False" unprotected="False">
+        <IPv4 id="id41D295E7" name="firewall30:eth0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
       </Interface>
-          <Management address="192.168.1.1">
+      <Interface bridgeport="False" dyn="False" id="id41D295E8" name="eth2" security_level="0" unnum="False" unprotected="False">
+        <IPv4 id="id41D29600" name="firewall30:eth2:ip" address="192.168.2.1" netmask="255.255.255.0"/>
+      </Interface>
+      <Management address="192.168.1.1">
         <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
         <FWBDManagement enabled="True" identity="" port="9999"/>
         <PolicyInstallScript arguments="" command="" enabled="False"/>
       </Management>
-          <FirewallOptions>
+      <FirewallOptions>
         <Option name="accept_established">True</Option>
         <Option name="accept_new_tcp_with_no_syn">True</Option>
         <Option name="action_on_reject">ICMP host prohibited</Option>
-        <Option name="activationCmd"/>
-        <Option name="admUser"/>
-        <Option name="altAddress"/>
+        <Option name="activationCmd"></Option>
+        <Option name="admUser"></Option>
+        <Option name="altAddress"></Option>
         <Option name="bridging_fw">False</Option>
         <Option name="check_shading">False</Option>
         <Option name="clamp_mss_to_mtu">False</Option>
-        <Option name="cmdline"/>
-        <Option name="compiler"/>
+        <Option name="cmdline"></Option>
+        <Option name="compiler"></Option>
         <Option name="configure_interfaces">True</Option>
         <Option name="debug">False</Option>
         <Option name="drop_invalid">False</Option>
         <Option name="dyn_addr">False</Option>
-        <Option name="epilog_script"/>
-        <Option name="firewall_dir"/>
+        <Option name="epilog_script"></Option>
+        <Option name="firewall_dir"></Option>
         <Option name="firewall_is_part_of_any">True</Option>
         <Option name="firewall_is_part_of_any_and_networks">True</Option>
-        <Option name="id"/>
+        <Option name="id"></Option>
         <Option name="ignore_empty_groups">False</Option>
-        <Option name="install_script"/>
+        <Option name="install_script"></Option>
         <Option name="limit_suffix">/day</Option>
         <Option name="limit_value">0</Option>
-        <Option name="linux24_accept_redirects"/>
-        <Option name="linux24_accept_source_route"/>
-        <Option name="linux24_icmp_echo_ignore_all"/>
-        <Option name="linux24_icmp_echo_ignore_broadcasts"/>
-        <Option name="linux24_icmp_ignore_bogus_error_responses"/>
-        <Option name="linux24_ip_dynaddr"/>
-        <Option name="linux24_ip_forward"/>
-        <Option name="linux24_log_martians"/>
-        <Option name="linux24_path_ip"/>
-        <Option name="linux24_path_iptables"/>
-        <Option name="linux24_path_logger"/>
-        <Option name="linux24_path_lsmod"/>
-        <Option name="linux24_path_modprobe"/>
-        <Option name="linux24_rp_filter"/>
-        <Option name="linux24_tcp_ecn"/>
-        <Option name="linux24_tcp_fack"/>
+        <Option name="linux24_accept_redirects"></Option>
+        <Option name="linux24_accept_source_route"></Option>
+        <Option name="linux24_icmp_echo_ignore_all"></Option>
+        <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
+        <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
+        <Option name="linux24_ip_dynaddr"></Option>
+        <Option name="linux24_ip_forward"></Option>
+        <Option name="linux24_log_martians"></Option>
+        <Option name="linux24_path_ip"></Option>
+        <Option name="linux24_path_iptables"></Option>
+        <Option name="linux24_path_logger"></Option>
+        <Option name="linux24_path_lsmod"></Option>
+        <Option name="linux24_path_modprobe"></Option>
+        <Option name="linux24_rp_filter"></Option>
+        <Option name="linux24_tcp_ecn"></Option>
+        <Option name="linux24_tcp_fack"></Option>
         <Option name="linux24_tcp_fin_timeout">30</Option>
         <Option name="linux24_tcp_keepalive_interval">1800</Option>
-        <Option name="linux24_tcp_sack"/>
-        <Option name="linux24_tcp_syncookies"/>
-        <Option name="linux24_tcp_timestamps"/>
-        <Option name="linux24_tcp_window_scaling"/>
+        <Option name="linux24_tcp_sack"></Option>
+        <Option name="linux24_tcp_syncookies"></Option>
+        <Option name="linux24_tcp_timestamps"></Option>
+        <Option name="linux24_tcp_window_scaling"></Option>
         <Option name="load_modules">False</Option>
         <Option name="local_nat">False</Option>
         <Option name="log_all">False</Option>
         <Option name="log_all_dropped">False</Option>
         <Option name="log_invalid">False</Option>
         <Option name="log_ip_opt">False</Option>
-        <Option name="log_level"/>
-        <Option name="log_limit_suffix"/>
+        <Option name="log_level"></Option>
+        <Option name="log_limit_suffix"></Option>
         <Option name="log_limit_value">0</Option>
-        <Option name="log_prefix"/>
+        <Option name="log_prefix"></Option>
         <Option name="log_tcp_opt">False</Option>
         <Option name="log_tcp_seq">False</Option>
         <Option name="manage_virtual_addr">True</Option>
-        <Option name="mgmt_addr"/>
+        <Option name="mgmt_addr"></Option>
         <Option name="mgmt_ssh">False</Option>
         <Option name="no_iochains_for_any">False</Option>
         <Option name="no_optimisation">False</Option>
-        <Option name="output_file"/>
+        <Option name="output_file"></Option>
         <Option name="platform">iptables</Option>
         <Option name="prolog_place">top</Option>
-        <Option name="prolog_script"/>
-        <Option name="script_env_path"/>
-        <Option name="snmp_contact"/>
-        <Option name="snmp_description"/>
-        <Option name="snmp_location"/>
+        <Option name="prolog_script"></Option>
+        <Option name="script_env_path"></Option>
+        <Option name="snmp_contact"></Option>
+        <Option name="snmp_description"></Option>
+        <Option name="snmp_location"></Option>
         <Option name="ulog_cprange">0</Option>
         <Option name="ulog_nlgroup">1</Option>
         <Option name="ulog_qthreshold">1</Option>
@@ -22158,21 +25227,21 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
         <Option name="use_numeric_log_levels">False</Option>
         <Option name="verify_interfaces">True</Option>
       </FirewallOptions>
-          </Firewall>
+    </Firewall>
     <Interface bridgeport="False" dyn="False" id="id41F62C5C" name="eth3" security_level="0" unnum="False" unprotected="False">
-      <IPv4 address="22.22.23.23" id="id41F62C60" name="firewall30:eth3:ip" netmask="255.255.255.0"/>
+      <IPv4 id="id41F62C60" name="firewall30:eth3:ip" address="22.22.23.23" netmask="255.255.255.0"/>
     </Interface>
     <Interface bridgeport="False" dyn="False" id="id41F62C52" name="eth2" security_level="100" unnum="False" unprotected="False">
-      <IPv4 address="192.168.2.1" comment="" id="id41F62C56" name="firewall30:eth2:ip" netmask="255.255.255.0"/>
+      <IPv4 comment="" id="id41F62C56" name="firewall30:eth2:ip" address="192.168.2.1" netmask="255.255.255.0"/>
     </Interface>
     <Interface bridgeport="False" comment="" dyn="False" id="id429910E6" label="fw8:eth2" mgmt="True" name="eth2" security_level="100" unnum="False" unprotected="False">
-      <IPv4 address="192.168.100.1" id="id429910EA" name="firewall31:eth2:ip" netmask="255.255.255.0"/>
+      <IPv4 id="id429910EA" name="firewall31:eth2:ip" address="192.168.100.1" netmask="255.255.255.0"/>
     </Interface>
     <Interface bridgeport="False" comment="VLAN interface" dyn="True" id="id43868A7E1434" label="" mgmt="False" name="eth0.200" security_level="0" unnum="False" unprotected="False"/>
     <Interface bridgeport="False" comment="" dyn="False" id="id4492FF5124380" label="" mgmt="True" name="eth1" security_level="100" unnum="False" unprotected="False">
-      <IPv4 address="192.168.1.1" comment="" id="id4492FF5324380" name="firewall40:eth1:ip" netmask="255.255.255.0"/>
+      <IPv4 comment="" id="id4492FF5324380" name="firewall40:eth1:ip" address="192.168.1.1" netmask="255.255.255.0"/>
     </Interface>
-    <IPv4 address="0.0.0.0" id="id4492FF5F24380" name="firewall40:eth0:ip-1" netmask="0.0.0.0"/>
+    <IPv4 id="id4492FF5F24380" name="firewall40:eth0:ip-1" address="0.0.0.0" netmask="0.0.0.0"/>
     <Library color="#d2ffd0" comment="" id="id44EC13FB8791" name="tmp" ro="False">
       <ObjectGroup id="id44EC13FC8791" name="Objects">
         <ObjectGroup id="id44EC13FD8791" name="Addresses"/>
@@ -22184,19 +25253,25 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
         <ObjectGroup id="id44EC14038791" name="Address Ranges"/>
       </ObjectGroup>
       <ServiceGroup id="id44EC14048791" name="Services">
-      <ServiceGroup id="id44EC14048791_userservices" name="User"/>
-        <ServiceGroup id="id44EC14058791" name="Groups"/><ServiceGroup id="id44EC14068791" name="ICMP"/><ServiceGroup id="id44EC14078791" name="IP"/><ServiceGroup id="id44EC14088791" name="TCP"/><ServiceGroup id="id44EC14098791" name="UDP"/><ServiceGroup id="id44EC140A8791" name="Custom"/><ServiceGroup id="id44EC140B8791" name="TagServices"/>
+        <ServiceGroup id="id44EC14048791_userservices" name="User"/>
+        <ServiceGroup id="id44EC14058791" name="Groups"/>
+        <ServiceGroup id="id44EC14068791" name="ICMP"/>
+        <ServiceGroup id="id44EC14078791" name="IP"/>
+        <ServiceGroup id="id44EC14088791" name="TCP"/>
+        <ServiceGroup id="id44EC14098791" name="UDP"/>
+        <ServiceGroup id="id44EC140A8791" name="Custom"/>
+        <ServiceGroup id="id44EC140B8791" name="TagServices"/>
       </ServiceGroup>
       <ObjectGroup id="id44EC140C8791" name="Firewalls"/>
       <IntervalGroup id="id44EC140D8791" name="Time"/>
     </Library>
     <Interface bridgeport="False" dyn="False" id="id46EFBE4D31183" name="eth2" security_level="100" unnum="False" unprotected="False">
-      <IPv4 address="192.168.2.1" id="id46EFBE4F31183" name="firewall42:eth2:ip" netmask="255.255.255.0"/>
+      <IPv4 id="id46EFBE4F31183" name="firewall42:eth2:ip" address="192.168.2.1" netmask="255.255.255.0"/>
     </Interface>
     <Interface bridgeport="False" dyn="False" id="id46EFBE5331183" name="eth3" security_level="0" unnum="False" unprotected="False">
-      <IPv4 address="22.22.23.23" id="id46EFBE5531183" name="firewall42:eth3:ip" netmask="255.255.255.0"/>
+      <IPv4 id="id46EFBE5531183" name="firewall42:eth3:ip" address="22.22.23.23" netmask="255.255.255.0"/>
     </Interface>
-    <IPv4 address="192.168.1.1" id="id46EFBE4931183" name="firewall42:eth0:ip" netmask="255.255.255.0"/>
+    <IPv4 id="id46EFBE4931183" name="firewall42:eth0:ip" address="192.168.1.1" netmask="255.255.255.0"/>
   </Library>
   <Library color="#FFFFFF" comment="" id="id4387B43718346" name="transfer" ro="False">
     <ObjectGroup id="id4387B43818346" name="Objects">
@@ -22210,21 +25285,27 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
     </ObjectGroup>
     <ServiceGroup id="id4387B44018346" name="Services">
       <ServiceGroup id="id4387B44018346_userservices" name="User"/>
-        <ServiceGroup id="id4387B44018346_og_tag_1" name="TagServices"/><ServiceGroup id="id4387B44118346" name="Groups"/><ServiceGroup id="id4387B44218346" name="ICMP"/><ServiceGroup id="id4387B44318346" name="IP"/><ServiceGroup id="id4387B44418346" name="TCP"/><ServiceGroup id="id4387B44518346" name="UDP"/><ServiceGroup id="id4387B44618346" name="Custom"/>
-      </ServiceGroup>
+      <ServiceGroup id="id4387B44018346_og_tag_1" name="TagServices"/>
+      <ServiceGroup id="id4387B44118346" name="Groups"/>
+      <ServiceGroup id="id4387B44218346" name="ICMP"/>
+      <ServiceGroup id="id4387B44318346" name="IP"/>
+      <ServiceGroup id="id4387B44418346" name="TCP"/>
+      <ServiceGroup id="id4387B44518346" name="UDP"/>
+      <ServiceGroup id="id4387B44618346" name="Custom"/>
+    </ServiceGroup>
     <ObjectGroup id="id4387B44718346" name="Firewalls"/>
     <IntervalGroup id="id4387B44818346" name="Time"/>
   </Library>
   <Library color="#d4f8ff" comment="Standard objects" id="syslib000" name="Standard" ro="True">
     <ServiceGroup id="stdid05" name="Services">
-      <ServiceGroup id="stdid05_userservices" name="User"/>
-        <ServiceGroup id="stdid06" name="IP">
+      <ServiceGroup id="stdid06" name="IP">
         <IPService comment="IPSEC Encapsulating Security Payload Protocol" fragm="False" id="ip-IPSEC" lsrr="False" name="ESP" protocol_num="50" rr="False" short_fragm="False" ssrr="False" ts="False"/>
         <IPService comment="'Short' fragments" fragm="False" id="ip-IP_Fragments" lsrr="False" name="ip_fragments" protocol_num="0" rr="False" short_fragm="True" ssrr="False" ts="False"/>
         <IPService comment="Route recording packets" fragm="False" id="ip-RR" lsrr="False" name="RR" protocol_num="0" rr="True" short_fragm="False" ssrr="False" ts="False"/>
         <IPService comment="All sorts of Source Routing Packets" fragm="False" id="ip-SRR" lsrr="True" name="SRR" protocol_num="0" rr="False" short_fragm="False" ssrr="True" ts="False"/>
         <IPService comment="IPSEC Authentication Header Protocol" fragm="False" id="id3CB12797" lsrr="False" name="AH" protocol_num="51" rr="False" short_fragm="False" ssrr="False" ts="False"/>
-      </ServiceGroup><ServiceGroup id="stdid09" name="TCP">
+      </ServiceGroup>
+      <ServiceGroup id="stdid09" name="TCP">
         <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="113" dst_range_start="113" fin_flag="False" fin_flag_mask="False" id="tcp-Auth" name="auth" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
         <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="53" dst_range_start="53" fin_flag="False" fin_flag_mask="False" id="tcp-DNS_zone_transf" name="dns-tcp" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
         <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="21" dst_range_start="21" fin_flag="False" fin_flag_mask="False" id="tcp-FTP" name="ftp" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
@@ -22261,13 +25342,15 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
         <TCPService ack_flag="False" ack_flag_mask="True" comment="" dst_range_end="0" dst_range_start="0" fin_flag="False" fin_flag_mask="True" id="tcp-TCP-SYN" name="tcp-syn" psh_flag="False" psh_flag_mask="True" rst_flag="False" rst_flag_mask="True" src_range_end="0" src_range_start="0" syn_flag="True" syn_flag_mask="True" urg_flag="False" urg_flag_mask="True"/>
         <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="3128" dst_range_start="3128" fin_flag="False" fin_flag_mask="False" id="id3B4FF09A" name="squid" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
         <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="0" dst_range_start="0" fin_flag="False" fin_flag_mask="False" id="tcp-All_TCP" name="All TCP" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
-      </ServiceGroup><ServiceGroup id="stdid08" name="UDP">
+      </ServiceGroup>
+      <ServiceGroup id="stdid08" name="UDP">
         <UDPService comment="" dst_range_end="53" dst_range_start="53" id="udp-DNS" name="domain" src_range_end="0" src_range_start="0"/>
         <UDPService comment="" dst_range_end="161" dst_range_start="161" id="udp-SNMP" name="snmp" src_range_end="0" src_range_start="0"/>
         <UDPService comment="" dst_range_end="0" dst_range_start="0" id="udp-All_UDP" name="All UDP" src_range_end="0" src_range_start="0"/>
         <UDPService comment="" dst_range_end="67" dst_range_start="67" id="udp-bootps" name="bootps" src_range_end="0" src_range_start="0"/>
         <UDPService comment="" dst_range_end="68" dst_range_start="68" id="udp-bootpc" name="bootpc" src_range_end="0" src_range_start="0"/>
-      </ServiceGroup><ServiceGroup id="stdid10" name="Groups">
+      </ServiceGroup>
+      <ServiceGroup id="stdid10" name="Groups">
         <ServiceGroup comment="" id="sg-DHCP" name="DHCP">
           <ServiceRef ref="udp-bootpc"/>
           <ServiceRef ref="udp-bootps"/>
@@ -22282,7 +25365,8 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <ServiceRef ref="id3CB12797"/>
           <ServiceRef ref="ip-IPSEC"/>
         </ServiceGroup>
-      </ServiceGroup><ServiceGroup id="stdid07" name="ICMP">
+      </ServiceGroup>
+      <ServiceGroup id="stdid07" name="ICMP">
         <ICMPService code="0" comment="" id="icmp-ping_request" name="ping request" type="8"/>
         <ICMPService code="-1" comment="" id="icmp-Unreachables" name="all ICMP unreachables" type="3"/>
         <ICMPService code="-1" comment="" id="id3C20EEB5" name="any ICMP" type="-1"/>
@@ -22290,7 +25374,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
         <ICMPService code="1" comment="" id="icmp-Time_exceeded_in_transit" name="time exceeded in transit" type="11"/>
         <ICMPService code="0" comment="" id="icmp-ping_reply" name="ping reply" type="0"/>
       </ServiceGroup>
-      </ServiceGroup>
+    </ServiceGroup>
     <AnyNetwork comment="Any Network" id="sysid0" name="Any" address="0.0.0.0" netmask="0.0.0.0"/>
     <AnyInterval comment="Any Interval" from_day="-1" from_hour="-1" from_minute="-1" from_month="-1" from_weekday="-1" from_year="-1" id="sysid2" name="Any" to_day="-1" to_hour="-1" to_minute="-1" to_month="-1" to_weekday="-1" to_year="-1"/>
     <AnyIPService comment="Any IP Service" id="sysid1" name="Any" protocol_num="0"/>
diff --git a/test/pf/objects-for-regression-tests.fwb b/test/pf/objects-for-regression-tests.fwb
index 27a8ac010..8a5bcdbaf 100644
--- a/test/pf/objects-for-regression-tests.fwb
+++ b/test/pf/objects-for-regression-tests.fwb
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
-<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="6" id="root">
+<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="7" id="root">
   <Library color="#d2ffd0" comment="User defined objects" id="syslib001" name="User" ro="False">
     <ObjectGroup id="stdid01_1" name="Objects">
       <ObjectGroup id="stdid01_1_og_ats_1" name="Address Tables">
@@ -489,9 +489,8 @@
           <CustomServiceCommand platform="pix"/>
           <CustomServiceCommand platform="unknown"/>
         </CustomService>
+      </ServiceGroup><ServiceGroup id="stdid05_1_userservices" name="User"/>
       </ServiceGroup>
-      <ServiceGroup id="stdid05_1_userservices" name="User"/>
-    </ServiceGroup>
     <ObjectGroup id="stdid12_1" name="Firewalls">
       <Firewall comment="this is simple firewall with two interfaces. Test regular policy rules, including IP_fragments rule" host_OS="openbsd" id="fw-firewall2" inactive="False" lastCompiled="1157930800" lastInstalled="0" lastModified="1202682308" name="firewall" platform="pf" ro="False" version="">
         <NAT id="nat-firewall2" name="NAT">
@@ -10046,9 +10045,8 @@
         <ObjectGroup id="id40E233F9" name="Address Ranges"/>
       </ObjectGroup>
       <ServiceGroup id="id40E233FA" name="Services">
-      <ServiceGroup id="id40E233FA_og_tag_1" name="TagServices"/><ServiceGroup id="id40E233FB" name="Groups"/><ServiceGroup id="id40E233FC" name="ICMP"/><ServiceGroup id="id40E233FD" name="IP"/><ServiceGroup id="id40E233FE" name="TCP"/><ServiceGroup id="id40E233FF" name="UDP"/><ServiceGroup id="id40E23400" name="Custom"/>
-      <ServiceGroup id="id40E233FA_userservices" name="User"/>
-    </ServiceGroup>
+      <ServiceGroup id="id40E233FA_og_tag_1" name="TagServices"/><ServiceGroup id="id40E233FB" name="Groups"/><ServiceGroup id="id40E233FC" name="ICMP"/><ServiceGroup id="id40E233FD" name="IP"/><ServiceGroup id="id40E233FE" name="TCP"/><ServiceGroup id="id40E233FF" name="UDP"/><ServiceGroup id="id40E23400" name="Custom"/><ServiceGroup id="id40E233FA_userservices" name="User"/>
+      </ServiceGroup>
       <ObjectGroup id="id40E23401" name="Firewalls"/>
       <IntervalGroup id="id40E23402" name="Time"/>
     </Library>
@@ -10067,9 +10065,8 @@
         <ObjectGroup id="id40D07E80" name="Address Ranges"/>
       </ObjectGroup>
       <ServiceGroup id="id40D07E81" name="Services">
-      <ServiceGroup id="id40D07E81_og_tag_1" name="TagServices"/><ServiceGroup id="id40D07E82" name="Groups"/><ServiceGroup id="id40D07E83" name="ICMP"/><ServiceGroup id="id40D07E84" name="IP"/><ServiceGroup id="id40D07E85" name="TCP"/><ServiceGroup id="id40D07E86" name="UDP"/><ServiceGroup id="id40D07E87" name="Custom"/>
-      <ServiceGroup id="id40D07E81_userservices" name="User"/>
-    </ServiceGroup>
+      <ServiceGroup id="id40D07E81_og_tag_1" name="TagServices"/><ServiceGroup id="id40D07E82" name="Groups"/><ServiceGroup id="id40D07E83" name="ICMP"/><ServiceGroup id="id40D07E84" name="IP"/><ServiceGroup id="id40D07E85" name="TCP"/><ServiceGroup id="id40D07E86" name="UDP"/><ServiceGroup id="id40D07E87" name="Custom"/><ServiceGroup id="id40D07E81_userservices" name="User"/>
+      </ServiceGroup>
       <ObjectGroup id="id40D07E88" name="Firewalls"/>
       <IntervalGroup id="id40D07E89" name="Time"/>
     </Library>
@@ -10096,9 +10093,8 @@
         <ObjectGroup id="id44EC14038791" name="Address Ranges"/>
       </ObjectGroup>
       <ServiceGroup id="id44EC14048791" name="Services">
-      <ServiceGroup id="id44EC14058791" name="Groups"/><ServiceGroup id="id44EC14068791" name="ICMP"/><ServiceGroup id="id44EC14078791" name="IP"/><ServiceGroup id="id44EC14088791" name="TCP"/><ServiceGroup id="id44EC14098791" name="UDP"/><ServiceGroup id="id44EC140A8791" name="Custom"/><ServiceGroup id="id44EC140B8791" name="TagServices"/>
-      <ServiceGroup id="id44EC14048791_userservices" name="User"/>
-    </ServiceGroup>
+      <ServiceGroup id="id44EC14058791" name="Groups"/><ServiceGroup id="id44EC14068791" name="ICMP"/><ServiceGroup id="id44EC14078791" name="IP"/><ServiceGroup id="id44EC14088791" name="TCP"/><ServiceGroup id="id44EC14098791" name="UDP"/><ServiceGroup id="id44EC140A8791" name="Custom"/><ServiceGroup id="id44EC140B8791" name="TagServices"/><ServiceGroup id="id44EC14048791_userservices" name="User"/>
+      </ServiceGroup>
       <ObjectGroup id="id44EC140C8791" name="Firewalls"/>
       <IntervalGroup id="id44EC140D8791" name="Time"/>
     </Library>
@@ -10125,9 +10121,8 @@
       <ObjectGroup id="id4386458B18448" name="DNS Names"/>
     </ObjectGroup>
     <ServiceGroup id="id415276CF" name="Services">
-      <ServiceGroup id="id415276CF_og_tag_1" name="TagServices"/><ServiceGroup id="id415276D0" name="Groups"/><ServiceGroup id="id415276D1" name="ICMP"/><ServiceGroup id="id415276D2" name="IP"/><ServiceGroup id="id415276D3" name="TCP"/><ServiceGroup id="id415276D4" name="UDP"/><ServiceGroup id="id415276D5" name="Custom"/>
-      <ServiceGroup id="id415276CF_userservices" name="User"/>
-    </ServiceGroup>
+      <ServiceGroup id="id415276CF_og_tag_1" name="TagServices"/><ServiceGroup id="id415276D0" name="Groups"/><ServiceGroup id="id415276D1" name="ICMP"/><ServiceGroup id="id415276D2" name="IP"/><ServiceGroup id="id415276D3" name="TCP"/><ServiceGroup id="id415276D4" name="UDP"/><ServiceGroup id="id415276D5" name="Custom"/><ServiceGroup id="id415276CF_userservices" name="User"/>
+      </ServiceGroup>
     <ObjectGroup id="id415276D6" name="Firewalls">
       <Firewall comment="firewall protects host it is running on&#10;&#10;Note that we set output file name to  /tmp/labfw.fw to test what compiler is going to do (since it generates three files rather than one), as well as to test installer in this case&#10;" host_OS="openbsd" id="id3AF5A2BA" inactive="False" lastCompiled="1172032243" lastInstalled="1172032344" lastModified="1172032234" name="labfw-openbsd" platform="pf" ro="False" version="">
         <NAT id="id3AF5A2BD" name="NAT">
@@ -11406,9 +11401,8 @@
       <ObjectGroup id="id4387B43F18346" name="Address Ranges"/>
     </ObjectGroup>
     <ServiceGroup id="id4387B44018346" name="Services">
-      <ServiceGroup id="id4387B44018346_og_tag_1" name="TagServices"/><ServiceGroup id="id4387B44118346" name="Groups"/><ServiceGroup id="id4387B44218346" name="ICMP"/><ServiceGroup id="id4387B44318346" name="IP"/><ServiceGroup id="id4387B44418346" name="TCP"/><ServiceGroup id="id4387B44518346" name="UDP"/><ServiceGroup id="id4387B44618346" name="Custom"/>
-      <ServiceGroup id="id4387B44018346_userservices" name="User"/>
-    </ServiceGroup>
+      <ServiceGroup id="id4387B44018346_og_tag_1" name="TagServices"/><ServiceGroup id="id4387B44118346" name="Groups"/><ServiceGroup id="id4387B44218346" name="ICMP"/><ServiceGroup id="id4387B44318346" name="IP"/><ServiceGroup id="id4387B44418346" name="TCP"/><ServiceGroup id="id4387B44518346" name="UDP"/><ServiceGroup id="id4387B44618346" name="Custom"/><ServiceGroup id="id4387B44018346_userservices" name="User"/>
+      </ServiceGroup>
     <ObjectGroup id="id4387B44718346" name="Firewalls"/>
     <IntervalGroup id="id4387B44818346" name="Time"/>
   </Library>
@@ -11481,9 +11475,8 @@
         <ICMPService code="0" comment="ICMP messages of this type are needed for traceroute" id="icmp-Time_exceeded" name="time exceeded" type="11"/>
         <ICMPService code="1" comment="" id="icmp-Time_exceeded_in_transit" name="time exceeded in transit" type="11"/>
         <ICMPService code="0" comment="" id="icmp-ping_reply" name="ping reply" type="0"/>
+      </ServiceGroup><ServiceGroup id="stdid05_userservices" name="User"/>
       </ServiceGroup>
-      <ServiceGroup id="stdid05_userservices" name="User"/>
-    </ServiceGroup>
     <AnyNetwork comment="Any Network" id="sysid0" name="Any" address="0.0.0.0" netmask="0.0.0.0"/>
     <AnyInterval comment="Any Interval" from_day="-1" from_hour="-1" from_minute="-1" from_month="-1" from_weekday="-1" from_year="-1" id="sysid2" name="Any" to_day="-1" to_hour="-1" to_minute="-1" to_month="-1" to_weekday="-1" to_year="-1"/>
     <AnyIPService comment="Any IP Service" id="sysid1" name="Any" protocol_num="0"/>
diff --git a/test/pf/quick-cmp.sh b/test/pf/quick-cmp.sh
index c2f36e22d..591cb91e6 100755
--- a/test/pf/quick-cmp.sh
+++ b/test/pf/quick-cmp.sh
@@ -2,7 +2,7 @@
 
 $XMLFILE=@ARGV[0];
 
-$DIFFCMD="diff -C 1 -b -B -c -I \"#  Generated\" -I 'Activating '  -I '#  Firewall Builder  fwb_pf v'";
+$DIFFCMD="diff -C 1 -b -B -c -I \"#  Generated\" -I 'Activating '  -I '#  Firewall Builder  fwb_pf v' -I '===='";
 
 
 while (<>) {