ingress policy should have dest net as local and src as other net