On (2012-02-01 20:07 +0100), Jonas Björklund wrote: > Is it possible to have different rules for incomning interface and lo0? In FW filter match 'interface-group x' and in interface set 'family x filter group x' These are mutually exclusive to the use of SCU/DCU, which likely is hardware limitation from the past, but certainly not any more in LU. -- ++ytti