diff --git a/TODO b/TODO
index d80b7cb8..d6733395 100644
--- a/TODO
+++ b/TODO
@@ -38,7 +38,6 @@ Globals
 - check incoming packets and log errors!!
 - check log calls for trailing newlines and log levels followed by comma
 - check if all protocols set proper packet priorities and TTL's.
-- replace all NUM, IPA and expr tokens by constant filter expressions
 - try compiling with -Wunused
 - does everybody test return value of sk_open?
 - doc: references to RFC's we did follow
diff --git a/conf/conf.h b/conf/conf.h
index 5abca7da..dbc747d6 100644
--- a/conf/conf.h
+++ b/conf/conf.h
@@ -86,6 +86,7 @@ struct symbol {
 #define SYM_FUNCTION 3
 #define SYM_FILTER 4
 #define SYM_TABLE 5
+#define SYM_IPA 6
 
 #define SYM_VARIABLE 0x100	/* 0x100-0x1ff are variable types */
 
diff --git a/conf/confbase.Y b/conf/confbase.Y
index 4626d440..588f5826 100644
--- a/conf/confbase.Y
+++ b/conf/confbase.Y
@@ -53,6 +53,7 @@ CF_DECLS
 
 %type <i> expr bool pxlen
 %type <time> datetime
+%type <a> ipa
 %type <px> prefix prefix_or_ipa
 
 %nonassoc '=' '<' '>' '~' '.' GEQ LEQ NEQ
@@ -96,6 +97,10 @@ definition:
      cf_define_symbol($2, SYM_NUMBER, NULL);
      $2->aux = $4;
    }
+ | DEFINE SYM '=' IPA ';' {
+     cf_define_symbol($2, SYM_IPA, cfg_alloc(sizeof(ip_addr)));
+     *(ip_addr *)$2->def = $4;
+   }
  ;
 
 /* Switches */
@@ -109,10 +114,18 @@ bool:
  | /* Silence means agreement */ { $$ = 1; }
  ;
 
-/* Prefixes and netmasks */
+/* Addresses, prefixes and netmasks */
+
+ipa:
+   IPA
+ | SYM {
+     if ($1->class != SYM_IPA) cf_error("IP address expected");
+     $$ = *(ip_addr *)$1->def;
+   }
+ ;
 
 prefix:
-   IPA pxlen {
+   ipa pxlen {
      if (!ip_is_prefix($1, $2)) cf_error("Invalid prefix");
      $$.addr = $1; $$.len = $2;
    }
@@ -120,15 +133,15 @@ prefix:
 
 prefix_or_ipa:
    prefix
- | IPA { $$.addr = $1; $$.len = BITS_PER_IP_ADDRESS; }
+ | ipa { $$.addr = $1; $$.len = BITS_PER_IP_ADDRESS; }
  ;
 
 pxlen:
-   '/' NUM {
+   '/' expr {
      if ($2 < 0 || $2 > BITS_PER_IP_ADDRESS) cf_error("Invalid prefix length %d", $2);
      $$ = $2;
    }
- | ':' IPA {
+ | ':' ipa {
      $$ = ipa_mklen($2);
      if ($$ < 0) cf_error("Invalid netmask %I", $2);
    }
diff --git a/filter/config.Y b/filter/config.Y
index 8988241b..9aa827e5 100644
--- a/filter/config.Y
+++ b/filter/config.Y
@@ -42,7 +42,7 @@ CF_KEYWORDS(FUNCTION, PRINT, PRINTN, UNSET, RETURN,
 %type <f> filter filter_body where_filter
 %type <i> type break_command pair
 %type <e> set_item set_items switch_body
-%type <v> set_atom fprefix fprefix_s ipa
+%type <v> set_atom fprefix fprefix_s fipa
 %type <s> decls declsn one_decl function_params 
 %type <h> bgp_path
 %type <i> bgp_one
@@ -224,14 +224,14 @@ fprefix:
  | fprefix_s '{' NUM ',' NUM '}' { $$ = $1; $$.val.px.len |= LEN_RANGE | ($3 << 16) | ($5 << 8); }
  ;
 
-ipa:
+fipa:
    IPA  { $$.type = T_IP; $$.val.px.ip = $1; }
  ;
 
 set_atom:
    NUM  { $$.type = T_INT; $$.val.i = $1; }
  | pair { $$.type = T_PAIR; $$.val.i = $1; }
- | ipa  { $$ = $1; }
+ | fipa { $$ = $1; }
  | fprefix { $$ = $1; }
  ; 
 
@@ -291,7 +291,7 @@ constant:
  | FALSE  { $$ = f_new_inst(); $$->code = 'c'; $$->aux = T_BOOL; $$->a2.i = 0;  }
  | TEXT   { $$ = f_new_inst(); $$->code = 'c'; $$->aux = T_STRING; $$->a2.p = $1; }
  | pair   { $$ = f_new_inst(); $$->code = 'c'; $$->aux = T_PAIR;  $$->a2.i = $1; }
- | ipa	   { NEW_F_VAL; $$ = f_new_inst(); $$->code = 'C'; $$->a1.p = val; *val = $1; }
+ | fipa	   { NEW_F_VAL; $$ = f_new_inst(); $$->code = 'C'; $$->a1.p = val; *val = $1; }
  | fprefix_s {NEW_F_VAL; $$ = f_new_inst(); $$->code = 'C'; $$->a1.p = val; *val = $1; }
  | '[' set_items ']' { DBG( "We've got a set here..." ); $$ = f_new_inst(); $$->code = 'c'; $$->aux = T_SET; $$->a2.p = build_tree($2); DBG( "ook\n" ); }
  | ENUM	  { $$ = f_new_inst(); $$->code = 'c'; $$->aux = $1 >> 16; $$->a2.i = $1 & 0xffff; }
diff --git a/nest/config.Y b/nest/config.Y
index 12671008..59046ee2 100644
--- a/nest/config.Y
+++ b/nest/config.Y
@@ -205,7 +205,7 @@ password_items:
  | FROM datetime password_items { last_password_item->from = $2; }
  | TO datetime password_items { last_password_item->to = $2; }
  | PASSIVE datetime password_items { last_password_item->passive = $2; }
- | ID NUM password_items { last_password_item->id = $2; }
+ | ID expr password_items { last_password_item->id = $2; }
  ;
 
 password_list: 
diff --git a/proto/bgp/config.Y b/proto/bgp/config.Y
index d864041c..397f9dd2 100644
--- a/proto/bgp/config.Y
+++ b/proto/bgp/config.Y
@@ -44,28 +44,28 @@ bgp_proto_start: proto_start BGP {
 bgp_proto:
    bgp_proto_start proto_name '{'
  | bgp_proto proto_item ';'
- | bgp_proto LOCAL AS NUM ';' {
+ | bgp_proto LOCAL AS expr ';' {
      if ($4 < 0 || $4 > 65535) cf_error("AS number out of range");
      BGP_CFG->local_as = $4;
    }
- | bgp_proto NEIGHBOR IPA AS NUM ';' {
+ | bgp_proto NEIGHBOR ipa AS expr ';' {
      if ($5 < 0 || $5 > 65535) cf_error("AS number out of range");
      BGP_CFG->remote_ip = $3;
      BGP_CFG->remote_as = $5;
    }
- | bgp_proto HOLD TIME NUM ';' { BGP_CFG->hold_time = $4; }
- | bgp_proto STARTUP HOLD TIME NUM ';' { BGP_CFG->initial_hold_time = $5; }
- | bgp_proto CONNECT RETRY TIME NUM ';' { BGP_CFG->connect_retry_time = $5; }
- | bgp_proto KEEPALIVE TIME NUM ';' { BGP_CFG->keepalive_time = $4; }
- | bgp_proto MULTIHOP NUM VIA IPA ';' { BGP_CFG->multihop = $3; BGP_CFG->multihop_via = $5; }
+ | bgp_proto HOLD TIME expr ';' { BGP_CFG->hold_time = $4; }
+ | bgp_proto STARTUP HOLD TIME expr ';' { BGP_CFG->initial_hold_time = $5; }
+ | bgp_proto CONNECT RETRY TIME expr ';' { BGP_CFG->connect_retry_time = $5; }
+ | bgp_proto KEEPALIVE TIME expr ';' { BGP_CFG->keepalive_time = $4; }
+ | bgp_proto MULTIHOP expr VIA ipa ';' { BGP_CFG->multihop = $3; BGP_CFG->multihop_via = $5; }
  | bgp_proto NEXT HOP SELF ';' { BGP_CFG->next_hop_self = 1; }
- | bgp_proto PATH METRIC NUM ';' { BGP_CFG->compare_path_lengths = $4; }
- | bgp_proto DEFAULT BGP_MED NUM ';' { BGP_CFG->default_med = $4; }
- | bgp_proto DEFAULT BGP_LOCAL_PREF NUM ';' { BGP_CFG->default_local_pref = $4; }
- | bgp_proto SOURCE ADDRESS IPA ';' { BGP_CFG->source_addr = $4; }
- | bgp_proto START DELAY TIME NUM ';' { BGP_CFG->start_delay_time = $5; }
- | bgp_proto ERROR FORGET TIME NUM ';' { BGP_CFG->error_amnesia_time = $5; } 
- | bgp_proto ERROR WAIT TIME NUM ',' NUM ';' { BGP_CFG->error_delay_time_min = $5; BGP_CFG->error_delay_time_max = $7; }
+ | bgp_proto PATH METRIC expr ';' { BGP_CFG->compare_path_lengths = $4; }
+ | bgp_proto DEFAULT BGP_MED expr ';' { BGP_CFG->default_med = $4; }
+ | bgp_proto DEFAULT BGP_LOCAL_PREF expr ';' { BGP_CFG->default_local_pref = $4; }
+ | bgp_proto SOURCE ADDRESS ipa ';' { BGP_CFG->source_addr = $4; }
+ | bgp_proto START DELAY TIME expr ';' { BGP_CFG->start_delay_time = $5; }
+ | bgp_proto ERROR FORGET TIME expr ';' { BGP_CFG->error_amnesia_time = $5; } 
+ | bgp_proto ERROR WAIT TIME expr ',' expr ';' { BGP_CFG->error_delay_time_min = $5; BGP_CFG->error_delay_time_max = $7; }
  | bgp_proto DISABLE AFTER ERROR ';' { BGP_CFG->disable_after_error = 1; }
  ;
 
diff --git a/proto/static/config.Y b/proto/static/config.Y
index 0197da36..a7e50164 100644
--- a/proto/static/config.Y
+++ b/proto/static/config.Y
@@ -43,7 +43,7 @@ stat_route0: ROUTE prefix {
  ;
 
 stat_route:
-   stat_route0 VIA IPA {
+   stat_route0 VIA ipa {
       this_srt->dest = RTD_ROUTER;
       this_srt->via = $3;
    }