don't program security rules in XS host if the zone is not SG enabled