A shared filter is a fleet-wide firewall filter owned by BGPTool: edit its terms once here, and Sync rewrites firewall family <fam> filter <name> on every attached router as one atomic commit (commit confirmed, auto-confirmed while the router stays reachable) — term order on the router is always exactly what you see here. Interface attachments are part of the filter: bind it to interface units (input/output) per router, and the same sync applies and removes the bindings. Terms can reference shared prefix-lists by name (e.g. source-prefix-list MGMT-ALLOW).