Fixed syntax of generated access-lists for ACE.
Don't warn on unused overlaps of disabled service.
Don't warn on unused overlap with disabled service
Prevent further errors if 'hardware' is missing.
Small code cleanup.
Fixed "protect own interfaces".

Check matching aggregate.
Clearer code in sub address.
Comment
Protect interfaces of mixed crosslink cluster.
New attribute 'vip' for virtual IP of loadbalancer.

Attribute 'vip' is currently only available for devices of type 'ACE'.
This is similar to a loopback interface. But a vip can't be used to
administratively access the device. Hence no code is generated to
protect the interface from access.
VIP interfaces are checked for missing aggregate rules.
New attribute 'dhcp_server' at interface.

This allows udp port 67 from and to any.
Added test case for HSRP (with single interface).
Fixed error message
New program 'print-service' to show expanded rules
Removed prototype from local subroutine.
v3.040

 - Added attribute 'dhcp_server' to interface.
   This adds an ACL which permits UDP port 67 to the interface.
 - Added attribute 'vip' to interface of loadbalancer.
   This is used to define a virtual IP similar to a 'loopback' interface.
   The difference is,
   - that no 'hardware' attribute is needed and
   - the interface is left out from "protect own interfaces".
   This is currently available for model 'ACE'.
 - Added new program 'print-service' to show expanded rules of a service.
 - Fixed syntax of generated access-lists for ACE.
 - Fixed "protect own interfaces"
   - check matching aggregates for possible access to interface,
   - protect IOS interface at ASA if both are connected by crosslink interface.
 - Removed pointless warning on overlaps with/at disabled sevices.