add limitation to provisioning in NAT environment