saving work on IOS compiler. some issues still:

- minor: (IpAddress = x) needs to be replaced with trivial truth
- minor: masks need to be replaced with CIDR notation

- not minor: need to decorrelate for routing, etc. the same way
we did for ACLs. For instance, the forward decision needs to override pass
and route.

- not minor: ON <what>(p)?
protocol etc. is part of the formulas! Do we need to filter out by tcp,
udp, ip, etc, and build separate rules?