diff --git a/conf/cf-lex.l b/conf/cf-lex.l
index 4f69993e..83e4e77c 100644
--- a/conf/cf-lex.l
+++ b/conf/cf-lex.l
@@ -654,6 +654,14 @@ cf_default_name(char *template, int *counter)
 static enum yytokentype
 cf_lex_symbol(const char *data)
 {
+  /* Have we defined such a symbol? */
+  struct symbol *sym = cf_get_symbol(data);
+  cf_lval.s = sym;
+
+  if (sym->class != SYM_VOID)
+    return CF_SYM_KNOWN;
+
+  /* Is it a keyword? */
   struct keyword *k = HASH_FIND(kw_hash, KW, data);
   if (k)
   {
@@ -666,19 +674,9 @@ cf_lex_symbol(const char *data)
     }
   }
 
-  cf_lval.s = cf_get_symbol(data);
-  switch (cf_lval.s->class) {
-    case SYM_VOID: return CF_SYM_VOID;
-    case SYM_PROTO: return CF_SYM_PROTO;
-    case SYM_TEMPLATE: return CF_SYM_TEMPLATE;
-    case SYM_FUNCTION: return CF_SYM_FUNCTION;
-    case SYM_FILTER: return CF_SYM_FILTER;
-    case SYM_TABLE: return CF_SYM_TABLE;
-    case SYM_ATTRIBUTE: return CF_SYM_ATTRIBUTE;
-    case SYM_VARIABLE_RANGE: return CF_SYM_VARIABLE;
-    case SYM_CONSTANT_RANGE: return CF_SYM_CONSTANT;
-    default: bug("Unknown symbol class %d", cf_lval.s->class);
-  }
+  /* OK, undefined symbol */
+  cf_lval.s = sym;
+  return CF_SYM_UNDEFINED;
 }
 
 static void
diff --git a/conf/confbase.Y b/conf/confbase.Y
index dcc92365..e104e54f 100644
--- a/conf/confbase.Y
+++ b/conf/confbase.Y
@@ -33,6 +33,21 @@ check_u16(uint val)
     cf_error("Value %u out of range (0-65535)", val);
 }
 
+#define cf_assert(cond, ...) do { if (!(cond)) cf_error(__VA_ARGS__); } while (0)
+static inline void cf_assert_symbol(const struct symbol *sym, uint class) {
+  switch (class) {
+    case SYM_PROTO: cf_assert(sym->class == SYM_PROTO, "Protocol name required"); break;
+    case SYM_TEMPLATE: cf_assert(sym->class == SYM_TEMPLATE, "Protocol template name required"); break;
+    case SYM_FUNCTION: cf_assert(sym->class == SYM_FUNCTION, "Function name required"); break;
+    case SYM_FILTER: cf_assert(sym->class == SYM_FILTER, "Filter name required"); break;
+    case SYM_TABLE: cf_assert(sym->class == SYM_TABLE, "Table name required"); break;
+    case SYM_ATTRIBUTE: cf_assert(sym->class == SYM_ATTRIBUTE, "Custom attribute name required"); break;
+    case SYM_VARIABLE: cf_assert((sym->class & ~0xff) == SYM_VARIABLE, "Variable name required"); break;
+    case SYM_CONSTANT: cf_assert((sym->class & ~0xff) == SYM_CONSTANT, "Constant name required"); break;
+    default: bug("This shall not happen");
+  }
+}
+
 CF_DECLS
 
 %union {
@@ -82,7 +97,7 @@ CF_DECLS
 %token <ip4> IP4
 %token <ip6> IP6
 %token <i64> VPN_RD
-%token <s> CF_SYM_VOID CF_SYM_PROTO CF_SYM_TEMPLATE CF_SYM_FUNCTION CF_SYM_FILTER CF_SYM_TABLE CF_SYM_ATTRIBUTE CF_SYM_VARIABLE CF_SYM_CONSTANT
+%token <s> CF_SYM_KNOWN CF_SYM_UNDEFINED
 %token <t> TEXT
 %type <iface> ipa_scope
 
@@ -92,6 +107,7 @@ CF_DECLS
 %type <net> net_ip4_ net_ip6_ net_ip6 net_ip_ net_ip net_or_ipa
 %type <net_ptr> net_ net_any net_vpn4_ net_vpn6_ net_vpn_ net_roa4_ net_roa6_ net_roa_ net_ip6_sadr_ net_mpls_
 %type <mls> label_stack_start label_stack
+%type <s> CF_SYM_VOID
 
 %type <t> text opttext
 %type <s> symbol
@@ -104,6 +120,8 @@ CF_DECLS
 %left '!'
 %nonassoc '.'
 
+%start config
+
 CF_KEYWORDS(DEFINE, ON, OFF, YES, NO, S, MS, US, PORT, VPN, MPLS, FROM)
 
 CF_GRAMMAR
@@ -137,8 +155,8 @@ definition:
 expr:
    NUM
  | '(' term ')' { $$ = f_eval_int(f_postfixify($2)); }
- | CF_SYM_CONSTANT {
-     if ($1->class != (SYM_CONSTANT | T_INT)) cf_error("Number expected");
+ | CF_SYM_KNOWN {
+     if ($1->class != (SYM_CONSTANT | T_INT)) cf_error("Number constant expected");
      $$ = SYM_VAL($1).i; }
  ;
 
@@ -148,17 +166,9 @@ expr_us:
  | expr US { $$ = $1 US_; }
  ;
 
-symbol:
-   CF_SYM_VOID
- | CF_SYM_PROTO
- | CF_SYM_TEMPLATE
- | CF_SYM_FUNCTION
- | CF_SYM_FILTER
- | CF_SYM_TABLE
- | CF_SYM_ATTRIBUTE
- | CF_SYM_VARIABLE
- | CF_SYM_CONSTANT
- ;
+CF_SYM_VOID: CF_SYM_UNDEFINED ;
+
+symbol: CF_SYM_VOID | CF_SYM_KNOWN ;
 
 /* Switches */
 
@@ -177,8 +187,8 @@ bool:
 ipa:
    IP4 { $$ = ipa_from_ip4($1); }
  | IP6 { $$ = ipa_from_ip6($1); }
- | CF_SYM_CONSTANT {
-     if ($1->class != (SYM_CONSTANT | T_IP)) cf_error("IP address expected");
+ | CF_SYM_KNOWN {
+     if ($1->class != (SYM_CONSTANT | T_IP)) cf_error("IP address constant expected");
      $$ = SYM_VAL($1).ip;
    }
  ;
@@ -292,27 +302,27 @@ net_:
 
 net_ip6:
    net_ip6_
- | CF_SYM_CONSTANT {
+ | CF_SYM_KNOWN {
      if (($1->class != (SYM_CONSTANT | T_NET)) || (SYM_VAL($1).net->type != NET_IP6))
-       cf_error("IPv6 network expected");
+       cf_error("IPv6 network constant expected");
      $$ = * SYM_VAL($1).net;
    }
  ;
 
 net_ip:
    net_ip_
- | CF_SYM_CONSTANT {
+ | CF_SYM_KNOWN {
      if (($1->class != (SYM_CONSTANT | T_NET)) || !net_is_ip(SYM_VAL($1).net))
-       cf_error("IP network expected");
+       cf_error("IP network constant expected");
      $$ = * SYM_VAL($1).net;
    }
  ;
 
 net_any:
    net_
- | CF_SYM_CONSTANT {
+ | CF_SYM_KNOWN {
      if ($1->class != (SYM_CONSTANT | T_NET))
-       cf_error("Network expected");
+       cf_error("Network constant expected");
      $$ = (net_addr *) SYM_VAL($1).net; /* Avoid const warning */
    }
  ;
@@ -322,13 +332,13 @@ net_or_ipa:
  | net_ip6_
  | IP4 { net_fill_ip4(&($$), $1, IP4_MAX_PREFIX_LENGTH); }
  | IP6 { net_fill_ip6(&($$), $1, IP6_MAX_PREFIX_LENGTH); }
- | CF_SYM_CONSTANT {
+ | CF_SYM_KNOWN {
      if ($1->class == (SYM_CONSTANT | T_IP))
        net_fill_ip_host(&($$), SYM_VAL($1).ip);
      else if (($1->class == (SYM_CONSTANT | T_NET)) && net_is_ip(SYM_VAL($1).net))
        $$ = * SYM_VAL($1).net;
      else
-       cf_error("IP address or network expected");
+       cf_error("IP address or network constant expected");
    }
  ;
 
@@ -359,8 +369,8 @@ time:
 
 text:
    TEXT
- | CF_SYM_CONSTANT {
-     if ($1->class != (SYM_CONSTANT | T_STRING)) cf_error("String expected");
+ | CF_SYM_KNOWN {
+     if ($1->class != (SYM_CONSTANT | T_STRING)) cf_error("String constant expected");
      $$ = SYM_VAL($1).s;
    }
  ;
diff --git a/filter/config.Y b/filter/config.Y
index a7618987..3eccc3ed 100644
--- a/filter/config.Y
+++ b/filter/config.Y
@@ -489,7 +489,8 @@ custom_attr: ATTRIBUTE type CF_SYM_VOID ';' {
 
 conf: bt_test_suite ;
 bt_test_suite:
- BT_TEST_SUITE '(' CF_SYM_FUNCTION ',' text ')' {
+ BT_TEST_SUITE '(' CF_SYM_KNOWN ',' text ')' {
+  cf_assert_symbol($3, SYM_FUNCTION);
   struct f_bt_test_suite *t = cfg_allocz(sizeof(struct f_bt_test_suite));
   t->fn = $3->function;
   t->fn_name = $3->name;
@@ -501,7 +502,9 @@ bt_test_suite:
 
 conf: bt_test_same ;
 bt_test_same:
- BT_TEST_SAME '(' CF_SYM_FUNCTION ',' CF_SYM_FUNCTION ',' NUM ')' {
+ BT_TEST_SAME '(' CF_SYM_KNOWN ',' CF_SYM_KNOWN ',' NUM ')' {
+  cf_assert_symbol($3, SYM_FUNCTION);
+  cf_assert_symbol($5, SYM_FUNCTION);
   struct f_bt_test_suite *t = cfg_allocz(sizeof(struct f_bt_test_suite));
   t->fn = $3->function;
   t->cmp = $5->function;
@@ -589,7 +592,8 @@ filter_body:
  ;
 
 filter:
-   CF_SYM_FILTER {
+   CF_SYM_KNOWN {
+     cf_assert_symbol($1, SYM_FILTER);
      $$ = $1->filter;
    }
  | filter_body {
@@ -699,7 +703,8 @@ set_atom:
      if (f_eval(f_postfixify($2), cfg_mem, &($$)) > F_RETURN) cf_error("Runtime error");
      if (!f_valid_set_type($$.type)) cf_error("Set-incompatible type");
    }
- | CF_SYM_CONSTANT {
+ | CF_SYM_KNOWN {
+     cf_assert_symbol($1, SYM_CONSTANT);
      if (!f_valid_set_type(SYM_TYPE($1))) cf_error("%s: set-incompatible type", $1->name);
      $$ = *$1->val;
    }
@@ -858,15 +863,25 @@ constructor:
 
 
 function_call:
-   CF_SYM_FUNCTION '(' var_list ')' {
+   CF_SYM_KNOWN '(' var_list ')' {
      $$ = f_new_inst(FI_CALL, $1, $3);
    }
  ;
 
-symbol_value:
-   CF_SYM_CONSTANT { $$ = f_new_inst(FI_VARIABLE, $1); }
- | CF_SYM_VARIABLE { $$ = f_new_inst(FI_VARIABLE, $1); }
- | CF_SYM_ATTRIBUTE { $$ = f_new_inst(FI_EA_GET, *$1->attribute); }
+symbol_value: CF_SYM_KNOWN
+  {
+    switch ($1->class) {
+      case SYM_CONSTANT_RANGE:
+      case SYM_VARIABLE_RANGE:
+	$$ = f_new_inst(FI_VARIABLE, $1);
+	break;
+      case SYM_ATTRIBUTE:
+	$$ = f_new_inst(FI_EA_GET, *$1->attribute);
+	break;
+      default:
+	cf_error("Can't get value of symbol %s", $1->name);
+    }
+  }
  ;
 
 static_attr:
@@ -993,11 +1008,17 @@ cmd:
  | IF term THEN block ELSE block {
      $$ = f_new_inst(FI_CONDITION, $2, $4, $6);
    }
- | CF_SYM_ATTRIBUTE '=' term ';' {
-   $$ = f_new_inst(FI_EA_SET, $3, *$1->attribute);
-   }
- | CF_SYM_VARIABLE '=' term ';' {
-   $$ = f_new_inst(FI_SET, $3, $1);
+ | CF_SYM_KNOWN '=' term ';' {
+     switch ($1->class) {
+       case SYM_VARIABLE_RANGE:
+	 $$ = f_new_inst(FI_SET, $3, $1);
+	 break;
+       case SYM_ATTRIBUTE:
+	 $$ = f_new_inst(FI_EA_SET, $3, *$1->attribute);
+	 break;
+       default:
+	 cf_error("Can't assign to symbol %s", $1->name);
+     }
    }
  | RETURN term ';' {
      DBG( "Ook, we'll return the value\n" );
@@ -1038,7 +1059,7 @@ get_cf_position:
 };
 
 lvalue:
-   CF_SYM_VARIABLE { $$ = (struct f_lval) { .type = F_LVAL_VARIABLE, .sym = $1 }; }
+   CF_SYM_KNOWN { cf_assert_symbol($1, SYM_VARIABLE); $$ = (struct f_lval) { .type = F_LVAL_VARIABLE, .sym = $1 }; }
  | PREFERENCE { $$ = (struct f_lval) { .type = F_LVAL_PREFERENCE }; }
  | static_attr { $$ = (struct f_lval) { .type = F_LVAL_SA, .sa = $1 }; }
  | dynamic_attr { $$ = (struct f_lval) { .type = F_LVAL_EA, .da = $1 }; };
diff --git a/nest/config.Y b/nest/config.Y
index c2622ed2..fe642489 100644
--- a/nest/config.Y
+++ b/nest/config.Y
@@ -88,7 +88,7 @@ CF_ENUM(T_ENUM_ROA, ROA_, UNKNOWN, VALID, INVALID)
 %type <i32> idval
 %type <f> imexport
 %type <r> rtable
-%type <s> optproto sym_proto_or_template
+%type <s> optproto
 %type <ra> r_args
 %type <sd> sym_args
 %type <i> proto_start echo_mask echo_size debug_mask debug_list debug_flag mrtdump_mask mrtdump_list mrtdump_flag export_mode limit_action net_type table_sorted tos password_algorithm
@@ -114,7 +114,7 @@ idval:
    NUM { $$ = $1; }
  | '(' term ')' { $$ = f_eval_int(f_postfixify($2)); }
  | IP4 { $$ = ip4_to_u32($1); }
- | CF_SYM_CONSTANT {
+ | CF_SYM_KNOWN {
      if ($1->class == (SYM_CONSTANT | T_INT) || $1->class == (SYM_CONSTANT | T_QUAD))
        $$ = SYM_VAL($1).i;
      else if (($1->class == (SYM_CONSTANT | T_IP)) && ipa_is_ip4(SYM_VAL($1).ip))
@@ -173,8 +173,6 @@ proto_start:
  | TEMPLATE { $$ = SYM_TEMPLATE; }
  ;
 
-sym_proto_or_template: CF_SYM_PROTO | CF_SYM_TEMPLATE ;
-
 proto_name:
    /* EMPTY */ {
      struct symbol *s = cf_default_name(this_proto->protocol->template, &this_proto->protocol->name_counter);
@@ -186,20 +184,22 @@ proto_name:
      cf_define_symbol($1, this_proto->class, proto, this_proto);
      this_proto->name = $1->name;
    }
- | FROM sym_proto_or_template {
+ | FROM CF_SYM_KNOWN {
+     if (($2->class != SYM_TEMPLATE) && ($2->class != SYM_PROTO)) cf_error("Template or protocol name expected");
+
      struct symbol *s = cf_default_name(this_proto->protocol->template, &this_proto->protocol->name_counter);
      s->class = this_proto->class;
      s->proto = this_proto;
      this_proto->name = s->name;
 
-     if (($2->class != SYM_TEMPLATE) && ($2->class != SYM_PROTO)) cf_error("Template or protocol name expected");
      proto_copy_config(this_proto, $2->proto);
    }
- | CF_SYM_VOID FROM sym_proto_or_template {
+ | CF_SYM_VOID FROM CF_SYM_KNOWN {
+     if (($3->class != SYM_TEMPLATE) && ($3->class != SYM_PROTO)) cf_error("Template or protocol name expected");
+
      cf_define_symbol($1, this_proto->class, proto, this_proto);
      this_proto->name = $1->name;
 
-     if (($3->class != SYM_TEMPLATE) && ($3->class != SYM_PROTO)) cf_error("Template or protocol name expected");
      proto_copy_config(this_proto, $3->proto);
    }
  ;
@@ -256,7 +256,7 @@ channel_end:
 proto_channel: channel_start channel_opt_list channel_end;
 
 
-rtable: CF_SYM_TABLE { $$ = $1->table; } ;
+rtable: CF_SYM_KNOWN { cf_assert_symbol($1, SYM_TABLE); $$ = $1->table; } ;
 
 imexport:
    FILTER filter { $$ = $2; }
@@ -510,7 +510,7 @@ CF_CLI(SHOW PROTOCOLS ALL, proto_patt2, [<protocol> | \"<pattern>\"], [[Show rou
 { proto_apply_cmd($4, proto_cmd_show, 0, 1); } ;
 
 optproto:
-   CF_SYM_PROTO
+   CF_SYM_KNOWN { cf_assert_symbol($1, SYM_PROTO); $$ = $1; }
  | /* empty */ { $$ = NULL; }
  ;
 
@@ -542,7 +542,8 @@ r_args:
      $$->show_for = 1;
      $$->addr = $3;
    }
- | r_args TABLE CF_SYM_TABLE {
+ | r_args TABLE CF_SYM_KNOWN {
+     cf_assert_symbol($3, SYM_TABLE);
      $$ = $1;
      rt_show_add_table($$, $3->table->table);
      $$->tables_defined_by = RSD_TDB_DIRECT;
@@ -554,7 +555,8 @@ r_args:
        rt_show_add_table($$, t->table);
      $$->tables_defined_by = RSD_TDB_ALL;
    }
- | r_args IMPORT TABLE CF_SYM_PROTO '.' r_args_channel {
+ | r_args IMPORT TABLE CF_SYM_KNOWN '.' r_args_channel {
+     cf_assert_symbol($4, SYM_PROTO);
      $$ = $1;
      struct proto_config *cf = $4->proto;
      if (!cf->proto) cf_error("%s is not a protocol", $4->name);
@@ -586,7 +588,8 @@ r_args:
      $$ = $1;
      $$->filtered = 1;
    }
- | r_args export_mode CF_SYM_PROTO {
+ | r_args export_mode CF_SYM_KNOWN {
+     cf_assert_symbol($3, SYM_PROTO);
      struct proto_config *c = (struct proto_config *) $3->proto;
      $$ = $1;
      if ($$->export_mode) cf_error("Export specified twice");
@@ -595,7 +598,8 @@ r_args:
      $$->export_protocol = c->proto;
      $$->tables_defined_by = RSD_TDB_INDIRECT;
    }
- | r_args export_mode CF_SYM_PROTO '.' r_args_channel {
+ | r_args export_mode CF_SYM_KNOWN '.' r_args_channel {
+     cf_assert_symbol($3, SYM_PROTO);
      struct proto_config *c = (struct proto_config *) $3->proto;
      $$ = $1;
      if ($$->export_mode) cf_error("Export specified twice");
@@ -605,7 +609,8 @@ r_args:
      if (!$$->export_channel) cf_error("Export channel not found");
      $$->tables_defined_by = RSD_TDB_INDIRECT;
    }
- | r_args PROTOCOL CF_SYM_PROTO {
+ | r_args PROTOCOL CF_SYM_KNOWN {
+     cf_assert_symbol($3, SYM_PROTO);
      struct proto_config *c = (struct proto_config *) $3->proto;
      $$ = $1;
      if ($$->show_protocol) cf_error("Protocol specified twice");
@@ -643,7 +648,7 @@ r_args_for:
     $$ = cfg_alloc(sizeof(net_addr_ip6_sadr));
     net_fill_ip6_sadr($$, $1, IP6_MAX_PREFIX_LENGTH, $3, IP6_MAX_PREFIX_LENGTH);
   }
- | CF_SYM_CONSTANT {
+ | CF_SYM_KNOWN {
      if ($1->class == (SYM_CONSTANT | T_IP))
      {
        $$ = cfg_alloc(ipa_is_ip4(SYM_VAL($1).ip) ? sizeof(net_addr_ip4) : sizeof(net_addr_ip6));
@@ -652,7 +657,7 @@ r_args_for:
      else if (($1->class == (SYM_CONSTANT | T_NET)) && net_type_match(SYM_VAL($1).net, NB_IP | NB_VPN))
        $$ = (net_addr *) SYM_VAL($1).net; /* Avoid const warning */
      else
-       cf_error("IP address or network expected");
+       cf_error("IP address or network constant expected");
    }
  ;
 
@@ -775,13 +780,13 @@ CF_CLI(RESTRICT,,,[[Restrict current CLI session to safe commands]])
 { this_cli->restricted = 1; cli_msg(16, "Access restricted"); } ;
 
 proto_patt:
-   CF_SYM_PROTO { $$.ptr = $1; $$.patt = 0; }
+   CF_SYM_KNOWN { cf_assert_symbol($1, SYM_PROTO); $$.ptr = $1; $$.patt = 0; }
  | ALL  { $$.ptr = NULL; $$.patt = 1; }
  | TEXT { $$.ptr = $1; $$.patt = 1; }
  ;
 
 proto_patt2:
-   CF_SYM_PROTO { $$.ptr = $1; $$.patt = 0; }
+   CF_SYM_KNOWN { cf_assert_symbol($1, SYM_PROTO); $$.ptr = $1; $$.patt = 0; }
  |      { $$.ptr = NULL; $$.patt = 1; }
  | TEXT { $$.ptr = $1; $$.patt = 1; }
  ;
diff --git a/proto/ospf/config.Y b/proto/ospf/config.Y
index 38b09deb..66cf60c1 100644
--- a/proto/ospf/config.Y
+++ b/proto/ospf/config.Y
@@ -544,7 +544,7 @@ lsadb_args:
  | lsadb_args LSID idval { $$ = $1; $$->lsid = $3; }
  | lsadb_args SELF { $$ = $1; $$->router = SH_ROUTER_SELF; }
  | lsadb_args ROUTER idval { $$ = $1; $$->router = $3; }
- | lsadb_args CF_SYM_PROTO { $$ = $1; $$->proto = (struct ospf_proto *) proto_get_named($2, &proto_ospf); }
+ | lsadb_args CF_SYM_KNOWN { cf_assert_symbol($2, SYM_PROTO); $$ = $1; $$->proto = (struct ospf_proto *) proto_get_named($2, &proto_ospf); }
  ;
 
 CF_CODE