<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"></head><body dir="auto">Thanks Tony!<div dir="auto"><br></div><div dir="auto">This is essentially what we do today. In fact, I was ecstatic when acl's were finally able to be used for all address match-lists.</div><div dir="auto"><br></div><div dir="auto">However, (and I realize this not a common use case) with over 150,000 zones -- some in multiple views, with different sets of rules (e.g., allow-query, etc.). Even with short 3-5 character acl's, repeating them every few lines will make the file grow...a lot, and I expect to be at around 250,000 zones fairly soon.</div><div dir="auto"><br></div><div dir="auto">I understand I could play hide-the-body and stuff the acl's into include file(s), but this level of duplication has bothered me for a while I and was hoping for something a little more elegant.</div><div dir="auto"><br></div><div dir="auto">Having said this, your suggestion holds true and is appreciated!</div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto">Thanks,</div><div dir="auto">John</div><div dir="auto"><br></div><div><br></div><div align="left" dir="auto" style="font-size:100%;color:#000000"><div>-------- Original message --------</div><div>> From: Tony Finch <dot@dotat.at></div></div><br dir="auto">> You can sort of do what you want already, by defining<div dir="auto">> named ACLs. ACLs can refer to named ACLs: you can</div><div dir="auto">> include a named ACL or exclude it.<div dir="auto"><br><div dir="auto"><br dir="auto">Tony.<br dir="auto">-- <br dir="auto">f.anthony.n.finch <dot@dotat.at> https://dotat.at/<br dir="auto">work to the benefit of all</div></div></div></body></html>