7 files changed, 20 insertions, 7 deletions
diff --git a/templates/firewall/group/address-group/node.def b/templates/firewall/group/address-group/node.def
index 5b2e510..13b2e72 100644
--- a/templates/firewall/group/address-group/node.def
+++ b/templates/firewall/group/address-group/node.def
@@ -15,5 +15,7 @@ syntax:expression: pattern $VAR(@) "^[^!]" ; \
 syntax:expression: pattern $VAR(@) "^[^|;&$<>]*$" ; \
        "Firewall group name cannot contain shell punctuation"
 
-end: sudo /opt/vyatta/sbin/vyatta-ipset.pl --action=update-set \
-        --set-name="$VAR(@)" --set-type=address
+end: if sudo /opt/vyatta/sbin/vyatta-ipset.pl --action=update-set \
+        --set-name="$VAR(@)" --set-type=address; then
+       ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall group address-group $VAR(@)"
+     fi
diff --git a/templates/firewall/group/network-group/node.def b/templates/firewall/group/network-group/node.def
index 8e50b7d..263a772 100644
--- a/templates/firewall/group/network-group/node.def
+++ b/templates/firewall/group/network-group/node.def
@@ -15,6 +15,8 @@ syntax:expression: pattern $VAR(@) "^[^!]" ; \
 syntax:expression: pattern $VAR(@) "^[^|;&$<>]*$" ; \
        "Firewall group name cannot contain shell punctuation"
 
-end: sudo /opt/vyatta/sbin/vyatta-ipset.pl --action=update-set \
-        --set-name="$VAR(@)" --set-type=network
+end: if sudo /opt/vyatta/sbin/vyatta-ipset.pl --action=update-set \
+        --set-name="$VAR(@)" --set-type=network; then
+        ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall group network-group $VAR(@)"
+     fi
 
diff --git a/templates/firewall/group/port-group/node.def b/templates/firewall/group/port-group/node.def
index 949403e..1484be2 100644
--- a/templates/firewall/group/port-group/node.def
+++ b/templates/firewall/group/port-group/node.def
@@ -15,5 +15,7 @@ syntax:expression: pattern $VAR(@) "^[^!]" ; \
 syntax:expression: pattern $VAR(@) "^[^|;&$<>]*$" ; \
        "Firewall group name cannot contain shell punctuation"
 
-end: sudo /opt/vyatta/sbin/vyatta-ipset.pl --action=update-set \
-        --set-name="$VAR(@)" --set-type=port
+end: if sudo /opt/vyatta/sbin/vyatta-ipset.pl --action=update-set \
+        --set-name="$VAR(@)" --set-type=port; then
+        ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall group port-group $VAR(@)"
+     fi
diff --git a/templates/firewall/ipv6-name/node.def b/templates/firewall/ipv6-name/node.def
index 3501d9b..e7e1167 100644
--- a/templates/firewall/ipv6-name/node.def
+++ b/templates/firewall/ipv6-name/node.def
@@ -24,6 +24,7 @@ end: if sudo /opt/vyatta/sbin/vyatta-firewall.pl --update-rules "firewall ipv6-n
      else
        exit 1;
      fi
+     ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall ipv6-name $VAR(@)"
 
 create: sudo /opt/vyatta/sbin/vyatta-firewall.pl --setup ip6tables "firewall ipv6-name"
 
diff --git a/templates/firewall/name/node.def b/templates/firewall/name/node.def
index 0c3c096..c48eb6d 100644
--- a/templates/firewall/name/node.def
+++ b/templates/firewall/name/node.def
@@ -18,8 +18,12 @@ end: if sudo /opt/vyatta/sbin/vyatta-firewall.pl --update-rules "firewall name"
        then
           if sudo /opt/vyatta/sbin/vyatta-firewall.pl --teardown-ok "firewall name" ;
           then
-             sudo /opt/vyatta/sbin/vyatta-firewall.pl --teardown "firewall name"
+             if sudo /opt/vyatta/sbin/vyatta-firewall.pl --teardown "firewall name"; then
+                ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall name $VAR(@)"
+             fi
           fi
+       else
+          ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall name $VAR(@)"
        fi
      else
        exit 1;
diff --git a/templates/firewall/node.def b/templates/firewall/node.def
index c71966b..ef135d6 100644
--- a/templates/firewall/node.def
+++ b/templates/firewall/node.def
@@ -1,2 +1,3 @@
 priority: 199
 help: Firewall
+end: ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="$VAR(@)"
+\ No newline at end of file
diff --git a/templates/firewall/state-policy/node.def b/templates/firewall/state-policy/node.def
index 230f090..3843f7c 100644
--- a/templates/firewall/state-policy/node.def
+++ b/templates/firewall/state-policy/node.def
@@ -32,3 +32,4 @@ end:
           --action=enable-disable-conntrack; then               \
           exit 1
         fi
+        ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall state-policy $VAR(@)"