> (But finally, you create GROUP-IN and GROUP-OUT rules ? I thinked you > wanted common group rules) No, this is a miss-understanding. We need separate GROUP-IN and GROUP-OUT rules. My question was if we should allow to apply them independently. Currently, a VM can only use GROUP-IN for example. got it?