Thanks for the replies on this. After I had sent the message I realized that it was a kind of dumb one. Naturally rules must be used on all interfaces. I just got little overwhelmed ... the amount of interfaces requires to be extra careful. :-) Well I better get started or I never finish it. Interesting to see how it performs in production. -Vesa, SysAdmin