> What I wanted is to check the transition from > > 'enable = 0' to 'enable > 0' > > which triggers when the user turn on firewalling. > > you just test it it is 'enable > 1'? I finally noticed that 'enable > 1' is also good test, so please ignore me ;-) well thought - thanks!