anchors

anchors can be conditional:

anchor foo on dc0 from any to 10/8 port 80